Responsible Disclosure

Version 2026-08-08 — published and last updated: 8 August 2026, 10:00 CEST

This policy covers Coflnet-operated services and systems. Third-party platforms and data are outside its scope unless you have their separate authorization. The version shown when Coflnet receives a report governs that report’s safe harbour and reward eligibility; a later change does not retroactively narrow compliant activity or an award already approved.

Good-faith conditions

Research is permitted under our Terms only if you:

• use only your own accounts or systems you are authorized to test;
• minimize testing and stop if you encounter third-party or personal data;
• do not access, copy, retain, disclose or exfiltrate data beyond what is strictly necessary to demonstrate the issue;
• do not disrupt services, use denial-of-service or social-engineering techniques, establish persistence, or impair other users;
• do not exploit a vulnerability to obtain or retain credits, access, items or other benefits; and
• report privately, give us a reasonable opportunity to investigate and fix the issue, and comply with applicable law.

Report an issue

Email [email protected] or use our contact form. Include the affected service, reproduction steps, impact and relevant times, but do not send live secrets or unnecessary personal data.

You may report without disclosing your civil identity, for example through a pseudonymous account or reply address. Keep a stable private contact or case reference if you want us to ask follow-up questions or associate a later reward. An anonymous report is investigated on its merits, but cannot be paid out anonymously.

If we approve an award for an anonymous report, the reporting channel provides a one-time private claim token. Coflnet stores only its one-way hash. Keep the token until you have linked the award to your authenticated Coflnet account; Coflnet cannot recover it. Presenting it records the account and claim time. The token is not a payment credential and gives access only to that award.

When reporting is required

If your use reveals unauthorized access to another person’s account or data, or a material security, billing, payment, CoflCoin or credit defect that gives or could give you an unintended access or benefit, stop the affected use, do not retain the data or benefit and report the material facts privately without undue delay. The same applies to a defect you know creates an immediate, substantial risk to service or user security or integrity. You do not have to continue testing, investigate third-party systems or collect unnecessary evidence.

We encourage reports of ordinary display errors, inconvenience, minor defects and service degradation, but the Terms do not impose a blanket duty to report every such issue. Statutory customer remedies remain unaffected.

Safe harbour

If you follow this policy, Coflnet will not treat the research or report as misuse under its Terms or pursue contractual claims based solely on that compliant activity. This policy cannot authorize conduct affecting third parties, bind public authorities or waive mandatory rights.

Report rewards

We may recognize a useful, responsibly submitted security report, material service-degradation report or billing or credit defect after human review. Submission, first discovery and compliance with a duty to report do not by themselves guarantee an award. A pure duplicate that adds no material information, an unverifiable report, or evidence obtained without authorization or fabricated is ordinarily ineligible. A voluntary award decision does not limit your statutory defect, damages or reimbursement rights.

If we approve an award, we identify the report, the remuneration amount in EUR before withholding and excluding VAT, and the applicable payout threshold. The approved amount is recorded immediately in a separate EUR reward ledger and for accounting, even below the threshold. It is not CoflCoins or service credit and cannot be spent on a service or transferred to another user. Approved awards accumulate; reaching the threshold permits a manual payout request and does not trigger an automatic payment.

Payout requires private payee onboarding with legal identity, address, country and tax residence, private or business and VAT status, and the invoice, self-billing and payout information required by law. VAT that the recipient must legally charge is added separately; tax that Coflnet must legally withhold is deducted. We can pay only where a lawful payout, tax and accounting process is available.

If you are under 18, we do not pay out on your declaration alone. You choose whether your legal representative approves the payout and the payee onboarding in a recorded form, or whether the approved award stays in the ledger until you turn 18 and complete the onboarding. Either way the award keeps its approval date and amount, does not expire while it waits and is not lost because you were a minor when it was approved. See COMMERCE-5 of the Commerce and Programme Terms, the Core security-reporting clause and section 5 of the Privacy Policy.