Coordinated Vulnerability Disclosure Policy

Send your report to security@apoteka.dk.

Please include, as far as you are able:

• Which product or service is affected (app and version, or URL).
• What the problem is, and what an attacker could achieve with it.
• The steps needed to reproduce it, including any request or payload used.
• Screenshots, logs or a short video, if they make the issue clearer.
• How you would like to be credited, if we publish an acknowledgement.

Write in Danish or English. You may report anonymously or under a pseudonym; we will still handle the report, but we will not be able to keep you updated.

Do not include personal data belonging to other people in your report unless it is strictly necessary to demonstrate the issue.

In scope

• The Mit Apopro app for iOS and the Mit Apopro app for Android.
• apopro.dk and the backend interfaces the apps and the website depend on.
• Other systems operated by Apoteka ApS that you can reach from the internet.

Out of scope

• Services operated by third parties, including the Apple App Store, Google Play, payment providers and integrated chat or support tools. Report those to the party that operates them.
• Physical security, and any form of social engineering directed at our staff, our pharmacists, our customers or our suppliers.
• Denial-of-service testing, load testing, and any activity that degrades service for customers.

Reports we usually cannot act on

Findings from automated scanners with no demonstrated impact; missing or misconfigured security headers on their own; SPF, DKIM or DMARC configuration without a working attack; self-XSS; clickjacking on pages without a sensitive action; issues that only affect unsupported browsers or rooted and jailbroken devices; and general hardening advice not tied to a concrete vulnerability. You are welcome to send these anyway, but we will normally close them without a fix.

Only test against accounts and data that belong to you. If you come across personal data, health data or prescription data belonging to someone else, stop immediately, do not save or copy it, and tell us what you saw in your report. Do not use credentials, tokens or access you obtain to go further than proving that the vulnerability exists.

Do not modify or delete data, do not maintain access after demonstrating the issue, and do not run scans at a volume that affects our service for others.

Working days are Danish business days.

We do not offer payment for reports.

We handle reports through coordinated disclosure. We ask that you keep the details private until a fix is available, and we will work with you on the timing of any publication. Our default is that details may be published 90 days after we acknowledge the report, or earlier if a fix is out and we both agree. If we need longer, we will explain why and agree a new date with you rather than let the deadline pass in silence.

Where a vulnerability affects users of our products, we will inform them, and where the law requires it we will notify the relevant authorities.

If we find a vulnerability in a third-party or open-source component we use, we report it to that component's maintainers.

If you act in good faith and follow this policy, we will treat your research as authorised. We will not initiate legal proceedings against you, and we will not report you to the police in connection with it. If a third party brings a claim against you for activity that complied with this policy, we will make your compliance known.

Two limits we cannot remove. We can only speak for ourselves, not for other companies whose systems you may touch. And criminal prosecution in Denmark is a matter for the public authorities, not for us — our undertaking not to report you does not bind them.

If you are unsure whether something is within the rules, ask us at security@apoteka.dk before you test it.

We process the information in your report in order to investigate and fix the issue, on the basis of our legitimate interest in the security of our products. If you give us contact details, we use them to keep you informed. You are not required to identify yourself.

This policy is owned by the CPTO of Apoteka ApS and is reviewed at least once a year.