Vulnerability disclosure

Inkluso is operated by HEXENKRAFT s.r.o., Prague. We welcome good-faith reports of real security issues in our sites and online services. This page says how to reach us and what we expect from you. It covers the public production site inkluso.eu. Other HEXENKRAFT sites have their own disclosure page.

No bug bounty

There is no bug bounty and no paid reward. We do not pay for reports and we do not run a bounty programme on any platform.

Testing is not authorized

Unsolicited security testing, scanning, fuzzing or "permission to test" requests are not authorized. Using our public pages the way a normal user does is fine. Anything beyond that needs a prior written agreement from us, and we almost never give one. A request for scope or permission sent by email is not an agreement and will not be answered with one.

Out of scope

The list gives examples. Leaving something off the list does not put it in scope.

• Denial of service or load testing of any kind
• Social engineering of our staff, customers or partners
• Physical access to offices, devices or hosting
• Spam or unsolicited mail to our addresses or users
• Attacks on third-party services we use, for example Stripe, Hetzner or our email providers. Report those to the provider.
• Issues that only affect outdated browsers or operating systems
• Speculative reports with no proof of concept
• Automated scanner output with no demonstrated impact

How to report

Email hello@inkluso.eu. This is the Contact address in this host's security.txt at /.well-known/security.txt.

Subject: Security report: inkluso.eu

Include:

• The affected URL or product
• A description of the issue
• Steps to reproduce
• The impact you see
• Whether you have shared the issue anywhere else

Plain text or a short PDF is enough. Do not send executables, archives or large attachments.

What happens next

We try to acknowledge a report within a few business days. We keep you updated on a best-effort basis while we look into it. There is no fixed response or fix time.

Safe harbor

We will not pursue legal action against researchers who:

• report in good faith,
• stay within normal use of our public pages as described above, or within a prior written agreement with us,
• do not degrade or interrupt our services,
• do not access, copy or keep more data than is needed to demonstrate the issue, and stop and report if they come across data that is not theirs,
• do not share data they came across, and
• give us a reasonable chance to fix the issue before any public disclosure.

This is not a licence to attack us. Activity outside these conditions is not covered. This commitment is made by HEXENKRAFT s.r.o. only. It does not bind public authorities or third parties, and it does not limit what the law requires us to report or disclose.

Company

HEXENKRAFT s.r.o., Prague, Czech Republic. Legal information

Last updated: 28 October 2026.