Report a security issue
Found a flaw? Thank you. Here is how to tell us.
We welcome reports from researchers and from anyone who notices something wrong. Tell us privately first, give us time to fix it, and we will work with you in good faith.
How to report
- Email security@han-tak.com. Write in English or French.
- Describe the issue, where you found it, the steps to reproduce it and what an attacker could do with it.
- Please do not include more personal data than you need to show the problem.
What we promise
- We acknowledge your report within [ACKNOWLEDGEMENT TIME].
- We keep you informed while we investigate and fix it, and aim to fix confirmed issues within [FIX TIME].
- We credit you when the fix is public, if you wish.
- We will not take legal action against good-faith research that follows this policy.
What we ask
- Give us reasonable time to fix the issue before you share it publicly.
- Do not access, change or delete data that is not yours; stop as soon as you have shown the problem.
- Do not degrade our services (no denial-of-service, spam or social engineering of our people).
- Never test against a family’s HomeHub or phone without their written permission.
In scope
- All han-tak.com websites: han-tak.com, initiatives., tech., homehub., phone., help., status. and api.han-tak.com
- Han-Tak service domains (han-tak-service.com), once they are live
- Han-Tak products and apps, once they are released
Out of scope
- Reports from automated scanners without a demonstrated impact
- Missing best-practice headers with no security consequence
- Third-party services we link to (for example a workshop’s registration page)
Machine-readable contact details: /.well-known/security.txt