Security & responsible disclosure

We take the security of our websites, our recruitment platform and the personal data of candidates and clients seriously. Even so, a weakness can slip through. Did you find one? We would really like to hear about it, so we can fix it as quickly as possible.

How to report

E-mail your finding to info@recruit4.work with "Security" in the subject line.
Describe the problem and the steps to reproduce it, so we can confirm and fix it quickly. Screenshots or a short video help.
Tell us how we can reach you. You may stay anonymous if you prefer.
Give us reasonable time to fix the problem before you share it with anyone else (we aim for 90 days at most).

Please don't

Do not access, copy, change or delete data that is not yours. If you reach personal data by accident, stop, keep it to a minimum and tell us.
Do not use denial-of-service attacks, spam, physical attacks or social engineering (phishing, calling our staff).
Do not use automated scanners that put heavy load on our systems.
Do not install malware or leave backdoors, and do not try to keep access after you found the problem.

What you can expect from us

We reply within 5 working days and keep you updated while we work on a fix.
If you follow these rules, we will not take legal action against you for your report.
We treat your report confidentially and do not share your details without your permission.
With your permission we gladly thank you by name once the problem is fixed. We do not run a paid bug bounty.

Not in scope

Reports about missing best practices without a real security impact (for example a missing header on its own).
Problems in services of other companies we use (please report those to them directly).
Vulnerabilities that need physical access to a device, or a device that is already compromised.

Machine-readable

Our contact details for security reports are also published in /.well-known/security.txt (RFC 9116).