Limited-time event
Securing with Community
We built a security platform. Before real customers put their asset data in it, we would rather have people who actually know this field take it apart. Find something serious, tell us, and the account is yours.
01
Why we are doing this
SimpleSecurity is an all-in-one information security and compliance platform for Nordic SMBs — asset register, vulnerability scanning, uptime, certificate and email monitoring, risk register, incidents, supplier review and automated evidence for ISO 27001 and NIS2. It is built and run by one person: a working CISO with sixteen years in the field.
We are pre-launch. There is no customer data in the platform yet. That makes right now the only moment when finding a problem is cheap — for us and for the people who will trust it later. A security vendor that never invites people to look is asking you to take its word for it. We would rather not.
We do not run a paid bug bounty — this is a one-person, bootstrapped company and we are not going to pretend otherwise. What we offer instead is a real account, public credit if you want it, and a published account of what you found and what we fixed.
02 · Reward
The MVP account
Report something we judge serious and you get an MVP account: every service on the platform unlocked, with a 20-asset cap, free for six months. It is not a trial — it is the full product, including the modules that normally sit on the top tier.
Compliance, risk, vendor, incidents, policies, change register, awareness training, and every monitor
Enough to run something real, capped because this is a thank-you rather than a free enterprise licence
From the day it is granted. No card, no auto-renewal, nothing to cancel
On our hall of fame, if you want it. Entirely optional — plenty of people prefer not to
03
Scope
In scope
- simplesecurity.se and the logged-in application
- Our API endpoints, reached with your own account
- Authentication, session handling and multi-factor flows
- Anything that lets one tenant see or touch another tenant’s data
- The public vendor-assessment and training portals
Out of scope
- Other people’s data. If you find a way in, stop and report it — do not go through it
- Denial of service, load testing, resource exhaustion
- Social engineering, phishing our founder, physical access
- Findings against AWS itself, or third-party services we merely consume
- Automated scanner output pasted without a working proof of concept
Expect the WAF to fight you. There is a real WAF and rate limiting in front of the site. If you get blocked, that is the product working — mention it in your report rather than assuming the platform is broken.
04
Safe harbour
We will not pursue or support legal action against anyone who researches in good faith within this policy. If you follow the scope and the rules below, we consider your testing authorised, and we will say so in writing if anyone ever asks.
If you accidentally step outside scope — it happens — stop, tell us what happened, and delete anything you pulled down. Telling us promptly keeps you inside the safe harbour. Quietly continuing does not.
05
Rules
- Test against your own account. Ask us and we will provision you a dedicated test tenant so you are not poking at production blind.
- Prove it, do not harvest it. One record is a proof of concept. A database dump is not.
- Report before you publish. We acknowledge within 72 hours and will agree a disclosure timeline with you. We will never ask you to stay quiet indefinitely.
- Leave the demo tenant alone as a target. It is deliberately read-only; breaking it proves nothing about the real product.
- One report per issue, with steps to reproduce, what you expected, and what happened.
06
What we consider serious
We judge every report on its own merits — but so that "serious" is not just a word, here is what clears the bar in practice:
- One tenant reading, writing or deleting another tenant’s data
- Authentication or MFA bypass; session fixation or takeover
- Privilege escalation — a read-only user performing writes, a customer reaching staff functions
- Remote code execution, or server-side request forgery reaching internal resources
- Unauthenticated access to any endpoint that changes data
- Anything that lets you bill, downgrade, or unlock a plan you did not pay for
Missing security headers, outdated library versions with no working exploit, and self-XSS do not qualify on their own — but if you can chain them into one of the above, that absolutely counts, and we would rather see it. The final call is ours, and we will explain our reasoning either way.
07
Get your test account
Most of what is worth finding here is behind a login — tenant isolation, access control, privilege boundaries. You cannot test that from the outside, so the account is part of the event, not the prize.
Public registration is closed. The link below carries the event code and opens a signup form anyway. You get your own isolated tenant with uptime and certificate monitoring on one asset — no other tenant's data is reachable from it, which is rather the point of what we would like you to test.
Creating an account through that link means you accept the rules and scope above. Accounts made for this event are removed when it closes — except the ones that found something, which keep the MVP access described earlier.
08
How to report
Email us. Include steps to reproduce, the impact as you see it, and how you would like to be credited if it qualifies.
We acknowledge every report within 72 hours. Reports go straight into our own incident workflow — the same one the product ships to customers — so nothing sits in an inbox unread.
This event runs for a limited period and closes once we are satisfied with the coverage. Responsible disclosure at security@simplesecurity.se stays open permanently, event or no event.