Security policy

The security of Ledgerly and our users' data is a priority. If you are a security researcher and believe you have found a vulnerability, this page explains how to report it responsibly. We welcome any good-faith report.

Scope

The following are in scope for this policy,

  • the web application on ledgerly.be and its subdomains
  • the account area, authentication, session and access management
  • the invoicing, VAT and accounting business logic

Out of scope

The following activities and reports are not accepted,

  • denial-of-service attacks (DoS, DDoS) and load testing
  • phishing, social engineering targeting our users or staff, spam
  • physical access, testing of the third-party services we rely on (payment, hosting, banking)
  • reports based solely on automated scanners without proof of real impact

Rules to follow

  • Test only with an account you created yourself, never access another user's data.
  • Do not extract, modify or delete any data, stop as soon as a flaw is demonstrated.
  • Do not degrade the service or disrupt its operation for other users.
  • Do not publicly disclose the vulnerability before it is fixed and we have given our consent.

How to report a vulnerability

Send us a detailed report by email. We will get back to you as soon as possible.

Security contact, security@ledgerly.be

  • a clear description of the vulnerability and its potential impact
  • precise steps to reproduce it (URL, requests, screenshots)
  • where relevant, a suggested fix

Our commitment

If you follow this policy and act in good faith,

  • we acknowledge your report and keep you informed of its handling
  • we fix confirmed flaws within a reasonable time depending on severity
  • we will not take legal action against you for testing carried out in line with these rules

Reward

Ledgerly does not offer a paid bug bounty program at this time. We do, however, warmly thank researchers for their contribution and may, with their consent, credit them publicly once the flaw is fixed.