Found something? Tell us first.
BlockTheChain runs on evidence, so it welcomes it. If you believe you have found a vulnerability in this website or any system operated by BlockTheChain, report it and it will be handled as an incident, not as an attack.
Through the contact form
Send details through the contact form. Include the affected URL or system, steps to reproduce, and the impact you observed. A machine-readable pointer lives at /.well-known/security.txt. Need encryption? Ask for a channel first. Reports are handled as described on /privacy.
This site and its labs, not the services behind them
In scope: blockthechain.nl and everything under it, including the browser-side labs. Out of scope: the third-party services the labs query (MDN HTTP Observatory, Have I Been Pwned, Cloudflare DNS, public Ethereum nodes, Sourcify, 4byte), Cloudflare's own platform and LinkedIn — please report those to their owners.
Acknowledgement within 2 business days
A first assessment within 5 business days, a fix or mitigation plan for confirmed findings, and a public thank-you below if you want one. No legal action against good-faith research that follows these rules.
A fix within 60 days, publication agreed with you
We aim to fix confirmed findings within 60 days and agree the publication moment with you. If a fix takes longer, we say why and agree a new date. There is no bug bounty; a public thank-you with your consent is the reward.
Keep it proportional
Test only what is needed to demonstrate the issue. Do not access, alter or store data that is not yours. Give a reasonable time to fix before any publication. Follow the NCSC-NL Coordinated Vulnerability Disclosure guideline.
No denial of service, no social engineering
No brute force, no automated scanning at scale, no phishing of the operator or third parties, no physical attacks. Reports about missing best practices without a demonstrated impact are noted, not rewarded.
Acknowledgements. No reports received yet. Researchers who report in good faith are listed here with their consent.
One message starts it.
Thirty minutes to scope it. A fixed-price proposal within two business days.