Vulnerability disclosure policy
Version 1.1. Published 1 October 2026, updated 29 October 2026.
If you believe you have found a security vulnerability in QuickISO, or something else here puts somebody's security at risk, we want to hear about it. This page says what you may report and test, how to tell us, and what we do in return.
QuickISO is run by Axperts Dariusz Zalewski, a sole proprietorship in Szczecin, Poland. The full details are in the privacy policy.
Report a security problem
A vulnerability, an incident in your workspace, phishing in our name or a privacy concern. You get a reference at once, and a person reads every report.
Or by email
What you can report
- a vulnerability in QuickISO
- a security incident affecting your workspace or your account, for example a sign in you do not recognise, a change nobody in your organization made, or data you think was exposed
- phishing or other abuse in QuickISO's name, for example a message or a site that pretends to be QuickISO, or QuickISO used against somebody
- a concern about how QuickISO handles personal data
QuickISO never asks you for a password or an authenticator code in an email, a chat message or a phone call. If a message in our name does, do not answer it, and report it here.
What you may test
| quickiso.app | the public site |
| eu.quickiso.app | the QuickISO application |
| us.quickiso.app | the page for the United States region |
| api.quickiso.app | the interface the application and the mobile apps use |
| the QuickISO mobile app |
Test only with your own accounts and workspaces, or with ones whose owner agreed to the testing. If you need an account to test something, write to us first. If you reach data that belongs to somebody else, stop there, do not keep or share it, and tell us what was visible.
What is out of scope
- denial of service, and any testing that makes the service worse for other people, including high volume automated scanning
- social engineering or phishing aimed at the people who work for us, our customers or our suppliers
- physical attacks on offices, equipment or data centres
- services run by other companies, such as our hosting, network and email providers; report those to the provider
- findings from automated tools without a demonstrated impact, such as a missing header on its own
How to report
Use the report form on this page. Choose what you are reporting, and tell us:
- what it is and where it is (the address or the screen)
- the steps to reproduce it, with a proof of concept if you have one
- what an attacker could achieve with it, or what it caused
- an email address we can answer at
The form takes no attachments. Put a proof of concept, a screenshot or a recording behind a link and paste the link, or describe it in the text.
Every report sent through the form gets a reference, for example QI-SEC-2026-0001. The page shows it as soon as the report is sent, and we email it to the address you give. Quote it in anything you send us about the report.
If you prefer email, write to [email protected] with the word "Security" at the start of the subject, in English or Polish, with the same details. We do not publish an encryption key yet. If your report is sensitive, send a short first message without the details, through the form or by email, and we will agree a safer way to share them.
What we commit to
Your report: through the form or by email.
5business days
Acknowledgement: at once for a form report, otherwise within five business days.
90days
A public write-up: we suggest 90 days from your report and are glad to agree a date.
- We confirm that we received your report within five business days. A report sent through the form is confirmed at once, by an email with its reference.
- A person reads every report. We tell you whether we could reproduce the problem and what we intend to do about it, and we tell you when it is fixed.
- When a report moves on, we may email you its new status: acknowledged, in progress, resolved, not applicable or duplicate. A status message says only where the report stands and never repeats what you wrote.
- We do not take legal action against you, and do not ask for you to be prosecuted, for research done in good faith and within this policy. This commitment binds us only; it cannot bind other companies or public authorities. The form asks you to confirm that any testing you did was within this policy.
- Personal data in your report is handled as section 3.12 of the privacy policy describes and used only to deal with the report.
Reporting an incident to QuickISO
A report of an incident tells QuickISO that something in QuickISO may have gone wrong for your workspace or your account. We investigate our side of it, we tell you what we find, and if personal data in your workspace was affected we tell your organization's owners without undue delay.
A report to QuickISO is not a notification to any authority, and it does not replace your organization's own obligations. If your organization is a key or important entity under the Polish act on the national cybersecurity system (KSC), a serious incident is yours to report to your sector CSIRT, with an early warning within 24 hours (article 11 of the act), whether or not QuickISO is involved. If your organization is the controller of personal data affected by a breach, notifying the supervisory authority is its duty as well (article 33 GDPR). Meet your own deadlines without waiting for our answer; we help with what we know.
What we ask of you
- Give us a reasonable time to fix the problem before you describe it publicly. We suggest 90 days from your report and are glad to agree a date with you.
- Do not access, change or delete more data than you need to demonstrate the problem.
- Do not use the vulnerability for anything beyond demonstrating it, and do not ask for payment in exchange for the details.
No bounty
We do not run a bug bounty programme and do not pay for reports. What we can offer is an honest answer and our thanks.
The same contact details, the form among them, are published in machine readable form at /.well-known/security.txt.