Vulnerability disclosure policy
Last updated: 22 October 2026
We take the security of owners' and building associations' data seriously. If you find a vulnerability in our services, we would like to hear about it. This policy explains what you may test, how to report an issue and what you can expect from us. General security information is on the Data security page.
1. In scope
- the profispravcesvj.cz website,
- the ProfiSprávceSVJ client portal at profispravcesvj.cz,
- monitor.profispravcesvj.cz (SVJ Monitor on the web),
- the ProfiSprávceSVJ and SVJ Monitor mobile apps for iOS and Android.
2. Out of scope
- denial of service (DoS, DDoS) and load testing,
- social engineering, phishing or other attempts targeting us, clients or suppliers,
- physical attacks on offices, devices or buildings,
- spam and mass form submissions,
- automated scanner output without a demonstrated impact (for example missing headers without an exploitable scenario, software versions, reports without reproduction steps),
- third-party services we use (for example Vercel, Supabase, Neon, Brevo, Cloudflare, Stripe, Cal.com). Please report issues in them directly to their operators.
3. Rules
- Access other people's data only as far as needed to prove the issue. Once proven, stop and do not open anything else.
- Do not download, copy, change or delete data. If you reach personal data, do not share it with anyone and delete it after reporting.
- Prefer testing with your own account or accounts you have permission to use.
- Give us time to fix the issue. Do not publish it until it is fixed or we agree otherwise.
- Do not break the law or disrupt the services for other users.
4. How to report
Write to svj@martinpohl.cz with the subject "Security". Describe what you found, where, how to reproduce it and what the impact could be. A screenshot or a sample request helps. Let us know whether you want to be listed in the hall of fame and under what name. The contact is also in /.well-known/security.txt.
5. What you can expect from us
These are our targets, not a contractual guarantee:
- acknowledgement of your report within 3 working days,
- an initial assessment and next steps within 10 working days,
- updates until the issue is fixed,
- confirmation once it is fixed and, with your consent, credit in the hall of fame.
6. Safe harbor
If you look for and report vulnerabilities in good faith and in line with this policy, we consider your research authorised. We will not take legal action against you or report it to law enforcement. If a third party complains about your research, we will make it known that you acted in line with this policy. If you are unsure whether something is allowed, ask us first.
7. Rewards
The programme currently offers no monetary rewards. For a valid report we will thank you with credit in the hall of fame on this page, if you wish.
8. Hall of fame
Thank you to the people who helped us improve our security:
Nobody here yet. You could be the first.