# Responsible disclosure

> How to report a security vulnerability in ShopAssist and what you can expect from us.

Source: https://shopassist.coec.dk/docs/security/responsible-disclosure · Updated 2026-10-01

Report vulnerabilities to [security@coec.dk](mailto:security@coec.dk). Please include the affected URL or component, the steps to reproduce and the impact you expect. Do not include shopper personal data you may have obtained.

* We acknowledge reports within 3 working days and keep you updated until the issue is fixed.
* We will not take legal action against good-faith research that follows the rules of our [disclosure policy](/security/disclosure).
* Test only against your own accounts and stores. Do not degrade the service, access other merchants' data or use social engineering.

The full policy, scope and safe-harbour terms are on the [disclosure policy page](/security/disclosure). Our [security.txt](/.well-known/security.txt) lists the same contact.