Please report (suspected) security vulnerabilities using the submit form on our security page: https://reccehq.com/security/. Reports are managed through our HackerOne program, so this is the preferred way to reach us.

If you cannot use the security page, you can email cybersecurity@reccehq.com instead.

We will respond to your report as soon as we can. In the response, we will confirm whether the vulnerability was indeed found, and we will discuss the steps towards a solution.

It's important to never publicly disclose a security vulnerability before it has been fully resolved, as this can potentially put the wider community at risk.

• Acknowledgement of receipt of the report
• Regular updates about the progress towards fixing the vulnerability
• An announced release date for the patch fixing the vulnerability

After the initial reply to your report, we will keep you informed of the progress towards a fix and full announcement. We aim to handle all security vulnerabilities in a timely manner. After the vulnerability has been fixed, we will publish a security advisory along with credit to the reporter if desired.

Thank you for helping to keep Recce and its users safe!