Report a security vulnerability

If you have found a security vulnerability in the ImmuSuisse app, in its data formats or on this website, write to us at [email protected] with the subject "Security".

Details we need

• the app version or page affected
• the steps to reproduce the problem
• what an attacker could do with it

What we commit to

We confirm your report within three working days. Within ten working days we tell you how we rate the problem and what we plan to do. We contact you as soon as the fix has been released. If an older app version can no longer be run safely, the app requires an update.

We welcome every report. Please test only with your own data and devices, and give us 90 days to fix the vulnerability before you publish anything about it. We see this as working together. In doing so, you have no legal action to fear from us.

No bounties

We do not pay bounties. ImmuSuisse is free and has no income from advertising or data.

Scope

You can report vulnerabilities in the app, in the data formats (export, Pod encryption, QR code), in the files under immusuisse.ch/api/v1 and on this website. Please report vulnerabilities at Solid Pod providers, Netlify, Cloudflare, Apple or Google to the provider concerned.