ImpactID is committed to protecting the confidentiality, integrity, and availability of our services and user data. We welcome reports from security researchers and will act quickly to validate, resolve, and publicly acknowledge legitimate findings.
| In scope | Out of scope |
|---|---|
| *.impactid.nl production systems | DoS / DDoS or stress-testing |
| Web, API, mobile apps | “Best-practice” headers only (unless exploitable) |
| Open-source repos under ImpactID org | Click-jacking on pages without sensitive data |
| 3rd-party services used by us | Rate-limit or brute-force tests |
Note: If you believe an out-of-scope issue can lead to a critical exploit, report it anyway — we will evaluate it.
If you follow this policy:
Please report any vulnerability via:
Include:
| Stage | Target Timeframe |
|---|---|
| Acknowledge report | ≤ 2 business days |
| Initial assessment | ≤ 5 days |
| Fix or mitigation | Depends on severity (usually ≤ 30 days) |
| Public disclosure | By mutual agreement after fix |
This policy does not grant permission to act unlawfully. ImpactID reserves the right to update this policy at any time.