Vulnerability Disclosure Policy (VDP)

At SEK, the security of our services and the privacy of our visitors are top priorities. We value the work of security researchers in making the internet safer and welcome the responsible disclosure of potential vulnerabilities on our public websites.

Reporting

If you believe you have discovered a vulnerability in any of our services, please report it to us as soon as possible via:

Email: abuse@sek.se

Please include a detailed description of the vulnerability, including steps to reproduce it, as well as any relevant screenshots or code snippets.

Our Commitment

If you follow this policy, we commit to:

Acknowledging receipt of your report within a reasonable timeframe (typically 3–5 business days).
Not taking any legal action against you as long as you act in good faith and follow the guidelines below.
Handling the matter confidentially and informing you once the vulnerability has been resolved.

Rules for Responsible Disclosure

To protect our systems and our users, we expect you to:

Not exploit the vulnerability to access, modify, or delete any data.
Not perform Denial of Service (DoS/DDoS) attacks or use social engineering (phishing) against our staff or customers.
Give us reasonable time to fix the issue before sharing any information publicly.

Compensation (Bug Bounty)

We do not currently offer financial compensation (bug bounties) for reported vulnerabilities. However, we greatly value and appreciate your contribution to our security and are happy to provide a formal acknowledgment of your assistance.