Security and vulnerability disclosure

Last updated: 28 July 2026

ChessCentrum welcomes reports about security weaknesses in our website and services. This page describes how to report a weakness to us, what you may and may not do while testing, and what you can expect from us in return. It follows the Coordinated Vulnerability Disclosure guideline published by the Dutch National Cyber Security Centre (NCSC-NL). ChessCentrum is a small, independent project run by one person, so the response times below are deliberately realistic rather than optimistic. We would rather hear about a problem than not hear about it.

How to report a weakness

Send your report by email to contact@chesscentrum.com. This is a monitored mailbox and it is the only reporting channel we operate. Please use the subject line “Security report” so that it is easy to recognise.

We do not currently publish a PGP key, so we cannot offer encrypted reporting yet. If your findings are too sensitive to send in plain email, say so in a first short message without any technical detail and we will agree on a safer channel with you before you send anything further.

Anonymous reports are accepted and taken just as seriously. Please be aware that if you do not leave any contact details we cannot ask follow-up questions, cannot keep you informed, and cannot credit you afterwards.

What to include in your report

A report we can reproduce is a report we can fix quickly. Please include as much of the following as you can.

The exact address, page or endpoint affected, and the parameter or input involved.
Step-by-step instructions to reproduce the issue, and the account or role you used.
What an attacker could actually achieve, in your own words, and how serious you think that is.
Any proof you needed to demonstrate the problem, such as a request, a screenshot or a short log excerpt, kept to the minimum.
The browser, operating system, date and time of your test, so we can find the matching server logs.
How you would like to be credited if we publish the fix, or that you prefer to stay anonymous.
Your contact details, if you want us to keep you informed.

What is in scope

The following systems are ours, and reports about them are welcome.

The public website chesscentrum.com and the application served under it. Subdomains operated on our behalf by third parties — our mail service in particular — are not ours to authorise testing on; report those to the operator.
The alternative domains chesscentrum.nl, chesscentrum.eu and chesscentrum.net, and their www variants, which all redirect to chesscentrum.com.
Our staging deployment of the same application, if you have already found it. We do not publish its address here, but a finding against it is just as welcome as one against the live site.
The application logic behind those hosts: sign-in and account management, email verification and password reset, the linked chess platform and federation features, the score-sheet scanner, the newsletter sign-up and confirmation flow, and the server actions and routes that support them.

What is out of scope

We run ChessCentrum on top of services operated by other companies. We cannot authorise testing of systems we do not own, and reports about them should go to the operator concerned rather than to us. Please do not test the following.

The infrastructure of Vercel, which hosts and serves the site.
The infrastructure of Supabase, which runs our database in Frankfurt.
The infrastructure of Resend, which delivers our transactional and newsletter email.
Google services, including the Maps JavaScript API used on the map page and Google sign-in where it is offered.
Lichess, which we use as a sign-in provider and as a public data source, and Chess.com, which we use as a public data source only.
Physical access to, or attacks against, any premises, hardware or post.
Social engineering, phishing or any other manipulation of the people behind ChessCentrum, of our suppliers, or of our users.
Volumetric denial-of-service, load testing, stress testing or anything else intended to exhaust capacity.
Raw output from an automated scanner, submitted without a demonstrated impact.

Rules for testing

You may investigate a suspected weakness, but only as far as is necessary to demonstrate that it exists. Once you have your proof, stop and report. If you keep to the rules below, we consider your research to be in good faith.

Do not access, download, copy, modify or delete data belonging to anyone else.
Create your own account and test against it. Never use someone else's account, and never brute-force or credential-stuff accounts that are not yours.
Stop at proof of concept. Do not pivot further into the system than the finding requires, and do not chain a finding into a wider compromise to see how far you can get.
Do not run denial-of-service, load or stress tests, and do not run automated scans at a rate that degrades the service for other people.
Do not install malware, backdoors, web shells or any other means of keeping access, and remove anything you did place as soon as you have finished.
Do not modify or deface anything, and do not send spam or bulk messages through our forms or our email.
Do not publish or share the weakness with anyone else before we have agreed on disclosure, as described below.
Keep to Dutch law, and act proportionately.

If you come across personal data

If your testing exposes personal data belonging to our users, stop immediately. Do not view more of it than you already have, do not download it, do not copy it and do not retain it. Tell us at once, describe what you saw in general terms rather than sending us the data itself, and delete anything you did capture as soon as we confirm that we have reproduced the problem.

Your own contact details, and the content of your report, are processed by us solely in order to handle the report, to fix the problem and to credit you if you want that. Our privacy policy explains how we handle personal data and what rights you have.

Reports we are unlikely to act on

The following are reported to us often and, on their own, do not describe a security problem we can act on. We will still read them, but please include a working, demonstrated impact if you want us to treat one of them as a vulnerability.

A missing or misconfigured security header without a demonstrated exploit.
Findings about our email records, such as SPF, DKIM or DMARC configuration, with no demonstrated abuse.
Self-XSS, or any issue that requires the victim to paste attacker-supplied code into their own browser.
Missing rate limiting on an endpoint with no demonstrated consequence.
An outdated library or dependency version, reported without a working exploit against our deployment.
Clickjacking on pages that carry no state-changing action.
User enumeration claims about flows we deliberately answer uniformly, such as newsletter sign-up and password reset.
Best-practice advice about the settings of our third-party providers, which we do not control.

What you can expect from us

ChessCentrum is run by one person alongside other work. These are commitments we are confident we can keep, not aspirations.

We acknowledge receipt of your report within 5 working days.
We give you a substantive assessment, including whether we can reproduce the issue and how we rate its severity, within 10 working days of that acknowledgement.
We keep you informed at least once every 14 days until the report is closed, even when the only news is that the fix is still in progress.
We aim to fix a confirmed weakness in our own code within 90 days. Where the fix depends on a third party or on a dependency we do not control, it can take longer, and we will tell you why and what we expect.
We tell you when the fix is live, so you can verify it.
We name you on the fix or in our release notes if you want the credit, using the name or handle you give us, and we say nothing about you at all if you prefer to stay anonymous.
We treat your report as confidential and do not pass your details to anyone else without your agreement, unless the law requires it.

Rewards: no bug bounty

ChessCentrum does not operate a bug bounty programme and does not pay monetary rewards for vulnerability reports. We would rather say this plainly up front than let you spend time on a report in the expectation of a payment.

What we do offer is a genuine thank you, public credit in the form you choose, and a straight answer about what we found and what we changed.

Coordinated disclosure and publication

We ask you to keep the weakness confidential until it has been fixed, and to agree the moment and the content of any publication with us first. Our default window is 90 days from the day we acknowledge your report, after which you are free to publish. That window is negotiable in both directions: a serious, easily exploited issue may deserve a shorter one, and a fix that depends on a third party may need a longer one.

If we are going to miss the agreed date, we will tell you before it passes, explain why, and propose a new one. We will not use a missed deadline as a reason to ask you to stay quiet indefinitely. Where we publish something ourselves, we will share the text with you in advance.

Our legal position

If you report a weakness to us, keep to the rules on this page, and act in good faith and proportionately, we will not report you to the police and will not bring civil proceedings against you. We regard your work as help, not as an attack.

That commitment lapses if you break the rules above, for example by going further than the proof required, by accessing or retaining other people's data, by damaging the service, or by abusing or selling the finding rather than reporting it.

We also have to be honest about a limit we cannot remove: this promise binds ChessCentrum only. It cannot bind the Dutch Public Prosecution Service, which may always decide independently to investigate or prosecute.

Escalation and reference details

If you are not satisfied with the way we handled your report, you may escalate it to the Dutch National Cyber Security Centre at cert@ncsc.nl, which can mediate between a reporter and an organisation.

The details below are also published in machine-readable form in our security.txt file.

Reporting address: contact@chesscentrum.com
This policy: https://chesscentrum.com/en/security
security.txt: https://chesscentrum.com/.well-known/security.txt
Preferred languages: Dutch, English, German, French, Spanish, Portuguese
Acknowledgement: Within 5 working days; substantive assessment within a further 10 working days
Disclosure window: 90 days by default, negotiable in either direction
Bug bounty: None. Public credit is offered instead, if you want it
Escalation: NCSC-NL, cert@ncsc.nl