Security

Vulnerability Disclosure Policy

Report a vulnerability

Introduction

MyClusters B.V. (“MyClusters”) takes the security of its products and services seriously. Our platform processes health data of people living with cluster headache, and we appreciate the work of security researchers who help us identify and remediate vulnerabilities. We want to make it easy and safe for you to do so. This policy describes the rules for reporting a vulnerability you have discovered.

Scope

The following are in scope:

  • https://myclusters.nl and its subdomains
  • The MyClusters iOS and Android apps
  • The MyClusters research dashboard, survey tools and ePRO tool
  • APIs supporting the services listed above

The following are out of scope:

  • Third-party services and platforms that MyClusters uses but does not operate (e.g. cloud hosting providers, app stores, newsletter and podcast platforms). Please report vulnerabilities in these services directly to the respective provider.
  • Social engineering (e.g. phishing) of MyClusters staff or contractors.
  • Physical attacks.
  • Denial-of-service (DoS) attacks.
  • Automated scanning that generates excessive traffic.

Legal posture and safe harbour

MyClusters will not pursue legal action against users who report vulnerabilities in good faith, stay within the scope of this policy, do not access or modify data beyond what is needed to demonstrate the issue, and respect the disclosure timeline.

Terms and conditions

  1. 01Do not publicly disclose the vulnerability until MyClusters has had a reasonable opportunity to investigate and remediate (typically 90 days from the date of the report).
  2. 02Do not access, modify, exfiltrate, or destroy data of MyClusters or its users. Use only accounts you own or have created for testing.
  3. 03If you inadvertently access personal or health data, stop testing immediately, do not store or share the data, and inform us in your report.
  4. 04Do not perform testing that disrupts the service for other users (no DoS, no automated scanning at rates that affect performance).
  5. 05Do not test accounts or environments of patients or research partners without their explicit prior consent.
  6. 06Reports must be submitted in English and contain enough detail to reproduce the issue.

How to submit a vulnerability

Send your report to security@myclusters.nl.

Send report

Include:

  • A clear description of the vulnerability and its impact.
  • Step-by-step instructions to reproduce, including any proof-of-concept code, screenshots, or videos.
  • The affected URL / endpoint / product and version where applicable.
  • Your contact details if you would like to receive updates and be credited.

What you can expect from us

  1. An acknowledgement of your report within 5 working days.

  2. An assessment and a target remediation timeline within 10 working days.

  3. Status updates as we investigate and fix the issue.

MyClusters does not operate a paid bug bounty programme and does not offer monetary rewards for reported vulnerabilities.

Acceptance criteria and prioritisation

Reports are assessed using the Common Vulnerability Scoring System (CVSS), taking into account the impact on the confidentiality, integrity and availability of our services and the personal data we process. Each validated report is prioritised as Critical, High, Medium or Low, and remediation is planned accordingly.

We typically do not accept the following reports:

  • Theoretical issues without demonstrable practical impact.
  • Missing best-practice headers or configurations without demonstrated exploitability.
  • Findings from automated scanners without validation.
  • Vulnerabilities in out-of-scope systems or that require out-of-scope techniques (e.g. social engineering, physical access, DoS).