Security
You found a vulnerability? Thank you for reporting it. Here is how to do that best.
What is covered
These rules apply to dev4life.de and all DEV4LIFE projects, for example haballes.de, including their subdomains.
How to report
Write to security@dev4life.de, preferably encrypted. Your mail app
finds the OpenPGP key through the Web Key Directory; on the command line use
gpg --locate-keys security@dev4life.de.
It helps to include:
- the affected address or feature,
- the steps to reproduce the issue,
- what an attacker could achieve with it,
- how to reach you, and whether you would like to be credited in the acknowledgements.
Please do not
- access, change or delete other users’ data; your own test account is enough,
- overload services or send large numbers of automated requests,
- deceive users or us (phishing, social engineering) or enter data centres,
- publish the issue before it is fixed or 90 days have passed.
What we promise
- We read every report and answer once we have looked into it.
- We keep you updated until the issue is fixed.
- If you follow these rules and act in good faith, we will not take legal action against you.
- If you like, we credit you below. We do not pay bounties.
Acknowledgements
Nobody yet. Maybe you?
The same information in machine-readable form is in our security.txt. The German version of this page is authoritative. Last updated: October 2026