Reporting a vulnerability
If you believe you have found a security vulnerability in the Conzent platform, the consent banner, or the open-source Conzent OCI core, we want to hear about it.
- Email: support@getconzent.com, or lennart@getconzent.com to reach the founder directly
- Machine-readable contact: /.well-known/security.txt (RFC 9116)
Please do not open a public GitHub issue for a security report. Our core is open source, so a public report is a working exploit disclosed to everyone running it, including people who cannot patch quickly. Email us instead and we will coordinate.
What to include
A report we can act on immediately usually has: the affected URL, endpoint or file; what an attacker can achieve; the steps to reproduce it; and anything you used to find it. A short proof of concept is worth more than a long description. Write in English or Danish.
What happens next
| Stage | Our commitment |
|---|---|
| Acknowledgement | Within 2 business days |
| Initial assessment, including whether we agree it is a vulnerability and its severity | Within 5 business days |
| Remediation plan with a target date | With the assessment, or as soon as the investigation allows |
| Confirmation once it is fixed | When the fix is deployed and, where relevant, released to self-hosted users |
Business days are Monday to Friday, excluding Danish public holidays. A report that shows active exploitation or exposed customer data is treated as an incident and handled ahead of everything else.
You will be dealt with by an engineer who can read and change the code, not by a triage queue. That is a genuine advantage of our size, and it is the reason these windows are short rather than aspirational.
What we ask of you
- Give us reasonable time to fix the issue before disclosing it publicly. We will agree a timeline with you rather than impose one, and we will not ask you to stay quiet indefinitely.
- Test only against your own account, your own sites, or a local Conzent OCI installation. Do not access, modify or retain other people's data.
- Do not run denial of service tests, send spam, or use social engineering against our staff or customers.
- If you encounter personal data, stop, and tell us what you saw rather than collecting it.
If you follow the above in good faith, we will not pursue legal action against you, and we will say so in writing if you need it.
Recognition
We do not currently run a paid bug bounty. We are happy to credit you by name in the release notes and here, if you want that, and we will tell you honestly when a report is a duplicate or out of scope rather than leaving you waiting.
Out of scope
Reports consisting only of automated scanner output, missing security headers with no demonstrated impact, missing SPF, DKIM or DMARC records, weak TLS ciphers without a working attack, self-XSS, or issues requiring a compromised device or physical access are generally out of scope. If you can show real impact, send it anyway and explain the impact.
The open-source core
Conzent OCI is published under the Apache 2.0 licence, so you can read the exact code that runs both our Cloud service and self-hosted installations. Vulnerabilities in the core affect people running it on their own infrastructure, so where a fix matters to them we publish it in the release notes and, when severity warrants, as an advisory in the repository.
If you run Conzent OCI yourself, replace /.well-known/security.txt with your own contact details before deploying: on your installation, that file should point at you.