Reporting a security vulnerability
If you believe you have found a security vulnerability in TimberTrail, write to info@kaudata.si and put "Security" in the subject. The same contact is published in machine-readable form at https://platform.timbertrail.si/.well-known/security.txt.
What is in scope
- the platform at https://platform.timbertrail.si;
- its connection for AI assistants at https://platform.timbertrail.si/api/mcp, and the sign-in and authorisation endpoints AI apps use to connect.
Not in scope: the EU Information System, which the European Commission operates; AI apps such as Claude or ChatGPT, which their providers operate; and the map images loaded from tile.openstreetmap.org. Report problems with those to their operators.
What to include
- what the vulnerability is and what an attacker could do with it;
- the steps to reproduce it, with the addresses or tools involved;
- whether you saw any data that is not yours, and what;
- how we can reach you.
Do not include other people's personal data in the report. We do not publish an encryption key for reports.
Rules for testing
- Use only your own account and your own organisation's data. If you come across someone else's data, stop, do not keep or share it, and tell us.
- Never file, amend or withdraw a statement in the EU production environment as a test. A filing there is a legal act that cannot be deleted. Do not send test traffic to the EU Information System at all.
- No denial of service, no load testing, no spam, no social engineering of our staff or our customers.
- Give us a reasonable time to fix the problem before you make it public.
What we do
We confirm that we have received the report, investigate it, and fix what we find. We may ask you questions while we do. We do not pay rewards for reports.
How the service protects data is described in section 8 of the privacy policy.