Security

Found something? Tell us before you tell anybody else.

Send it to privacy@doekworks.eu with enough detail to reproduce it. You will get a human acknowledgement within two business days.

What to send

Acknowledgement within two business days, from a person.
An assessment and an indication of timing, normally within a week.
A fix in a release, with the issue described in the release notes once instances have had a reasonable chance to update.
Credit in those notes, unless you asked otherwise.

Test against your own instance, or one you have permission to test.
Give us reasonable time before publishing. We will agree a date with you rather than ask you to wait indefinitely.
Report anything you are unsure about. A report that turns out to be intended behaviour is still worth our time, and we will explain why it is intended.

Test against somebody else's instance. TeamHub is self-hosted, so every running instance belongs to an organisation that did not invite you.
Access, alter or keep other people's data while demonstrating an issue.
Run denial-of-service or load testing against an instance that is not yours.

In scope. The TeamHub application, its API, and this website.
Out of scope. Nextcloud itself and other Nextcloud applications, which go to Nextcloud's own security process, and any individual organisation's deployment or configuration.
No bounty. Doek Works is a small company and does not run a paid programme. Saying so plainly is better than leaving you to find out after the work.
No legal action for good-faith research that follows this page.

A non-urgent bug that is not a security issue belongs on the public issue tracker, where it stays visible and other people can add to it.