Security & Responsible Disclosure

1.How we protect the platform

We use technical and organisational measures that match the risks of running a public research platform (Article 32 GDPR). They include:

• HTTPS for public connections and certificate-verified TLS for database connections;
• passwordless authentication: sign-in through identity providers and passkeys, an optional authenticator app for sensitive account actions, and sessions you can revoke yourself;
• least-privilege access to production systems, with security-relevant actions written to an append-only audit trail;
• isolation and malware scanning of uploaded files before publication or delivery;
• perimeter filtering, rate limiting, and abuse detection on all public endpoints;
• pseudonymisation of network identifiers in telemetry, with no raw IP addresses written to our database;
• layered browser protections (content-security policy, security headers, forgery protection);
• automated backups and tested recovery procedures.

No system is perfectly secure. We would rather hear about a weakness from a researcher before an attacker finds it.

2.Reporting a vulnerability

Report suspected vulnerabilities to info@world-wide.org with “Security” in the subject line. A useful report includes:

• the affected URL, endpoint, or component;
• steps to reproduce, with a proof of concept where possible;
• the impact you believe the issue has;
• your contact details for follow-up (anonymous reports are accepted).

Keep other people’s personal data in a report to the minimum needed to demonstrate the issue. We aim to acknowledge reports within 5 business days and to keep you informed while we investigate and fix the issue.

3.Rules of engagement

• do not degrade or disrupt the service: no denial-of-service, resource exhaustion or destructive testing;
• do not access, modify, or exfiltrate data belonging to others; if a flaw exposes such data, stop at the first evidence and report it;
• use your own test accounts wherever possible;
• no social engineering, phishing, or physical attacks against the association, its members, or its users;
• keep automated scanning to a rate that cannot affect service quality;
• do not demand payment for withholding a finding.

4.Coordinated disclosure

Give us reasonable time to fix the issue before any public disclosure. Our default is 90 days from acknowledgement. We will tell you if a structurally difficult fix needs longer, or if we finish early. Once a fix has shipped, we are happy to credit reporters who want to be named, and we equally respect anonymity.

5.Good-faith research

For World Wide systems that we control, we consider good-faith research within this page’s scope and rules to be authorised. We will not pursue civil action, make a criminal referral, or support a claim based solely on that compliant activity. If you accidentally reach another person’s data, stop, retain no more than the minimum evidence needed for the report, and notify us promptly. Continued access is outside this authorisation. This is not a promise of payment, immunity from generally applicable law, or permission to violate anyone else’s rights.

This commitment covers our own platform only. We cannot authorise testing of third-party services the platform uses (identity providers, map or media providers, infrastructure operators), and we cannot bind law-enforcement agencies or third parties, whose own rules and legal powers apply. If a third party questions activity that we verify as compliant with this policy, we may confirm that it was authorised for our systems.

6.Scope

In scope: world-wide.org and its APIs. Out of scope: vulnerabilities in third-party services we embed or depend on; findings that require physically compromised devices; reports that a public page is public; missing hardening flags without demonstrated impact; and the behaviour of intentionally public resources such as our open content listings.

7.If a breach happens

If a security incident leads to a personal-data breach, we assess it without undue delay. Where Articles 33 and 34 GDPR require it, we notify the Austrian supervisory authority and the people affected. The Data Retention & Deletion Policy and the Privacy Notice describe what we log, how long we keep it and how deletion works.