Responsible disclosure

Our commitment to security

At Hornet we take the security of our systems seriously, and we value the work of researchers who help us keep them that way. If you have found a vulnerability, email security@hornet.dev. We acknowledge every report within three business days.

How to report

Email security@hornet.dev with:

the affected asset: a URL, API endpoint, or hostname;
what the vulnerability lets an attacker actually do;
enough for us to reproduce it: steps, requests, logs, screenshots, or proof-of-concept code.

We will tell you what we found and let you know when it is fixed. We don't run a paid bug bounty. If you are not sure whether something is ours, ask before you start testing.

What we ask of you

Test against accounts and data that are yours, never real user data.
Stop at proof. Don't use a bug to get further into our systems, to establish persistence, or to find out how much you could reach.
If you find personal data, stop and report it. Send only the minimum needed to demonstrate the exposure, redacted where you can, and keep no copy once we have it. Tell us what you saw so we can work out whether we owe anyone a notification.
Don't delete, change, or degrade anything, and don't break the service for other people.
Manual testing and light scanning are fine. Denial of service, social engineering, physical access, and credential stuffing are not.
Give us a fair chance to fix the problem before you tell anyone else. Our default is 90 days from your report, extended only by agreement, and we won't ask you to stay quiet indefinitely.

If you realize partway through that you have gone further than you meant to, tell us. An honest account is more useful to us than reconstructing it from logs, and it does not cost you the safe harbor below.

Safe harbor

If you make a good faith effort to follow this policy while carrying out your research, we will treat your activity as authorized. We will work with you to understand and resolve the issue, and we will not pursue or recommend legal action against you in relation to it. If a third party brings legal action against you for activity carried out in accordance with this policy, we will make it known that your activity was authorized by us.

This assurance covers only claims that Hornet itself controls. It does not bind third parties, and it does not relieve you of the obligation to comply with the law. If at any point you are unsure whether your planned testing is consistent with this policy, contact us at security@hornet.dev before going any further.

Contact

Hornet AS
Ferjemannsveien 10
7042 Trondheim
Norway

Email: security@hornet.dev

Last updated: September 14, 2026

How to report

the affected asset: a URL, API endpoint, or hostname;

what the vulnerability lets an attacker actually do;

enough for us to reproduce it: steps, requests, logs, screenshots, or proof-of-concept code.

We will tell you what we found and let you know when it is fixed. We don't run a paid bug bounty. If you are not sure whether something is ours, ask before you start testing.

What we ask of you

Test against accounts and data that are yours, never real user data.

Stop at proof. Don't use a bug to get further into our systems, to establish persistence, or to find out how much you could reach.

If you find personal data, stop and report it. Send only the minimum needed to demonstrate the exposure, redacted where you can, and keep no copy once we have it. Tell us what you saw so we can work out whether we owe anyone a notification.

Don't delete, change, or degrade anything, and don't break the service for other people.

Manual testing and light scanning are fine. Denial of service, social engineering, physical access, and credential stuffing are not.

Give us a fair chance to fix the problem before you tell anyone else. Our default is 90 days from your report, extended only by agreement, and we won't ask you to stay quiet indefinitely.

Safe harbor