Security & disclosure.

If you find a security issue in this website or a Roja service, please tell us privately so we can assess it and coordinate the response.

Report a concern

Send the affected URL or service, a clear description, reproducible steps and the potential impact to security@roja.eu. Include your preferred contact method and any relevant timestamps. Please avoid sending customer data, passwords, tokens or unnecessary personal information.

Our discovery file is available at /.well-known/security.txt. A public contact makes reporting easier; it does not create permission to access data or systems beyond what is legally authorised.

Testing boundaries

Use your own accounts and the minimum activity needed to demonstrate the issue. Do not access or alter another person's data, disrupt service, attempt social engineering or conduct denial-of-service tests. Stop if you encounter sensitive information and report the location without copying or distributing it.

This policy is not a blanket testing authorisation or a legal safe-harbour promise. If your proposed test needs additional permission, agree the scope in writing before proceeding. Third-party services and customer systems are outside the scope of this policy.

How we handle reports

We review the report, identify the affected service and assess the impact. We may ask for clarification or a safe reproduction. We aim to acknowledge reports promptly but do not promise an unstaffed response-time guarantee. We coordinate next steps and publication with the reporter where appropriate, and handle applicable reporting duties separately.

Keep details private while we assess and address the issue. If you want public credit, tell us the name and link you would like used; recognition is agreed with you and does not imply a financial reward. There is no public bounty programme specified by this policy.

Data handling

Access to report details should be limited to the people investigating and responding. We retain relevant evidence to support remediation and applicable legal duties, then review it for deletion. See the privacy notice for the website processors and contact route.

Information that helps an investigation

Describe the service version, account type and minimum steps needed to reproduce the behaviour. Explain expected and observed results. Remove tokens, personal data and unrelated content from screenshots or traces. A precise, limited report usually makes triage easier than a large archive of unfiltered traffic.

If you cannot safely demonstrate impact without accessing another person's information, stop and explain the concern. We can agree a controlled reproduction or request clarification. Do not continue testing simply to make a report more dramatic. Reports should help the responsible team understand the issue while minimising disruption.

Coordination and follow-up

If the issue concerns a third-party provider, we may need to coordinate through an appropriate contact. We separate facts about our service from assumptions about systems outside our control. This policy does not extend a third party's testing authorisation. Use that organisation's published route where applicable.

After preparing a change, we may ask whether a limited retest confirms the original issue is addressed. We record the change and any remaining limitation. A public advisory should describe affected versions and mitigation without unnecessary personal information. Authority reporting and user communication are assessed on their own triggers and deadlines; coordination does not suspend those obligations.

Tell us if your contact details change while a report is open. If you receive no response, use the general contact page to ask whether the security report reached the team. Avoid reposting sensitive technical details in a public channel. We do not require reports to include an exploit that accesses other people's information.

Keep timestamps and the original report reference when following up. Where several issues are involved, separate the reproduction and impact for each one so the investigation can track distinct fixes. We may consolidate related reports, but will preserve the evidence needed to understand the original finding and the product version involved.