1. What this covers
Our own websites and apps, meaning everything we run ourselves:
- www.meaovis.com including the website audit and Website Monitoring,
- www.meareal.com, our photo editing app,
- www.meaunda.com and the MeaUnda app for iPhone and iPad.
Our clients' websites are not in this scope. If you have found a problem on a site we built but somebody else runs, write to us and we will put you in touch with the owner. Do not test somebody else's website without the owner's consent.
2. What to send us
The more specific the report, the faster the fix. It helps us to have:
- the address or endpoint it concerns,
- how to reproduce it, step by step if possible,
- what it can be used for, that is, the impact,
- the date and time you tried it,
- whether you reached anyone else's data in the process, and if so, what data.
Write in Slovak or in English, either is fine.
3. How we handle it
Reports go straight to a person, not to a shared mailbox. We confirm receipt within three working days. After that we write to you with our assessment, and let you know once the fix is out.
We are a small company, so we will not promise a deadline for the fix that we could not keep. What we do promise is that the report will not get lost and that you will know where it stands.
4. What we ask of you
Until we have fixed the problem, we ask you to:
- not access or download other people's data; a sample is enough as proof,
- not degrade the service, so no load or denial of service testing,
- not change or delete anyone else's content,
- not publish the details before the fix is out, and agree the timing with us,
- leave aside phishing, social engineering against our people or our clients, and physical access to premises.
If you stick to that, we treat the report as help and not as an attack.
5. What we do not offer
So that you do not count on it: we have no bug bounty programme and we do not pay for reports. We hold neither ISO 27001 certification nor a SOC 2 report. We are one person who is responsible for the security of his own services, and this is his address.
What we can offer: a credit by name on this page if you want one, and a straight answer about what we will do with the report.
6. Machine readable version
The same details are in the file /.well-known/security.txt as defined by RFC 9116, so that automated tools can find them too.