Security
Found a security problem? Email security@coenttb.com. I answer within three working days and keep it private until a fix ships.
What this covers
Every app I publish, such as Birdwatch and Kees, and coenttb.com itself, including the license server at /licenses/.
How to report
Email security@coenttb.com, in English or Dutch. Include:
- the app or page, and its version;
- what you found and what an attacker could do with it;
- the steps to reproduce it, and your macOS version where it matters.
Please don’t put details in a public issue, and don’t test against anyone’s data but your own.
What happens next
- Within three working days I confirm I have your report.
- I tell you whether I can reproduce it, and keep you posted until it is fixed.
- When the fix ships, I say so in the release notes and credit you, unless you’d rather not be named.
Disclosure
Please keep the details private until a fix ships, or for 90 days after your report, whichever comes first. If a fix needs longer, I’ll tell you why and we agree on a date together.
If a vulnerability is being actively exploited, I report it to the authorities as the EU Cyber Resilience Act requires.
Good faith
If you research in good faith, stay within this page and stop as soon as you’ve shown the problem, I won’t take legal action against you. Not in scope: denial of service, spam, and social engineering.
Security fixes
Security fixes are free for at least five years after you buy an app. When I fix a security problem in a version your license covers, you get that fix, even after your license’s updates have ended.
Machine-readable
The same contact is in /.well-known/security.txt (RFC 9116).