Vulnerability Disclosure Policy

We welcome feedback from security researchers and the general public to help improve our security. If you believe you have discovered a vulnerability, privacy issue, exposed data, or other security issues in any of our assets, we want to hear from you. This policy outlines steps for reporting vulnerabilities to us, what we expect, and what you can expect from us.

Systems in Scope

This policy applies to any digital assets owned, operated, or maintained by Ecosia GmbH.

Out-of-Scope Targets

The following assets and areas are considered out-of-scope for this program:

• Assets or other equipment not owned by parties participating in this policy. Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or applicable authority.
• Internal development and staging environments (e.g., staging.ecosia.org , dev.ecosia.org ).
• Third-party applications, integrations, or services not owned or controlled by Ecosia.
• Denial of Service (DoS) attacks, automated scanning, or resource exhaustion techniques.
• Social engineering attacks, including phishing campaigns targeting Ecosia employees.
• Physical security concerns such as attacks on Ecosia offices or employee workstations.

Legal Safe Harbor

When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:

• Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy.
• Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls.
• Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis.
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.

If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Timelines & SLAs

We have established internal processes to ensure the effective validation, triage and resolution of vulnerabilities. Ecosia will make a best effort to meet the following timelines:

1. Acknowledgement: Reports acknowledged within 72 hours.
2. Triage: Reports will be assessed for validity and triaged within 7 days.
3. Remediation: Valid vulnerabilities will be addressed in accordance with the defined patch timelines below.
4. Communication: We’ll do our best to keep you informed about our progress throughout the process.

Patch Timelines

All vulnerabilities will be patched following a risk-based approach that include an internal risk and impact assessment. Ecosia will make a best effort to meet the following timelines:

• Critical vulnerabilities: Addressed within 7-14 business days.
• High vulnerabilities: Addressed within 15-30 business days.
• Low & Medium vulnerabilities: Fix within 90 days and addressed during the next scheduled maintenance cycle.

Expectations from Researchers

When participating in our vulnerability disclosure program, researchers must:

• Follow this policy and any applicable agreements (this policy takes precedence if there’s a conflict).
• Report discovered vulnerabilities promptly.
• Avoid actions that compromise privacy, disrupt systems, destroy data, or degrade user experience.
• Communicate vulnerability details only through official channels.
• Test only in-scope systems and avoid out-of-scope areas.
• If a vulnerability exposes data, access only the minimum required, stop testing immediately upon encountering sensitive information (e.g. PII, PHI, credit card data), and report it.
• Use only test accounts you own or have permission to access.
• Never engage in extortion.

Report Quality

We value all submissions, but may not act on reports that:

• Lack enough detail to reproduce the issue
• Are based on speculation or unverifiable claims
• Contain only bulk scanner output without analysis
• Describe known, accepted, or already addressed issues
• Fall outside the program’s scope

We prioritise clear, actionable reports that improve our security posture.

Disclosure Policy

We ask that you provide us a reasonable amount of time to resolve the issue before any public disclosure. This means:

• Following HackerOne's disclosure guidelines.
• Please do not discuss vulnerabilities (even resolved ones) outside of the program without express consent from Ecosia

Submit a Vulnerability

Please use the form below. To receive updates on the reported vulnerability make sure to add your email address.

Please provide as much detail as possible to help us triage and resolve the issue. The more information you provide, the easier it will be for us to validate, triage, and fix the vulnerability.

Thank you for helping keep Ecosia and our users safe and assisting our fight against the climate crisis.

Contact our security officer

If you need contact us regarding any other security-related topics please use: our security email address: security@ecosia.org.