This page explains how to report a vulnerability or another security issue in JLW Automotive Solutions products and services.
Security contact
Łukasz Waszak, owner and person responsible for security, JLW Automotive Solutions Łukasz Waszak.
Where to report
Reports are accepted in Polish and English. Our security.txt file (RFC 9116) lists the same contact details.
Scope
- JLW Bridge: the workshop application and its modules,
- jlwauto.pl: company website and blog,
- app.jlwauto.pl: customer application,
- api2.jlwauto.pl: service and update server.
Third party services (hosting, payments, email) are out of scope. Please report issues in those services to their providers. If our configuration is also affected, let us know.
What to include
- the URL, component or program version affected,
- a description of the vulnerability and its possible impact,
- steps to reproduce and, if possible, a proof of concept,
- the date and time of testing and the IP address used,
- your contact details if you would like a reply.
Please do not attach personal data or customer data you were able to access. A description of how to reach it is enough.
Response times
- acknowledgement of receipt: within 5 business days,
- initial assessment and next steps: within 14 business days,
- notification of the fix: once it is deployed.
Please allow 90 days for a fix before publicly disclosing details. The deadline can be agreed individually.
Testing rules
- test only with your own account and your own data,
- do not read, modify or delete other people’s data beyond the minimum needed to demonstrate the issue,
- no denial of service, mass scanning or password guessing,
- no social engineering against us or our customers,
- do not test JLW Bridge on vehicles you do not own or have no owner’s consent for.
We will not pursue legal action against people who act in good faith and follow these rules.
Rewards
We do not run a bug bounty program with a price list and do not pay cash rewards. For a report that helped fix a real issue we may grant a discretionary reward in JLWAUTO tokens or a JLWAUTO license. Whether a reward is granted and its size are decided case by case.
No reward is granted for duplicate reports, automated scanner output without demonstrated impact, issues in third party services, or reports where the testing rules were broken.
With the reporter’s consent, we credit them by name once the issue is fixed.