Report a security vulnerability
Found a security vulnerability in winku.de or a Winku service, program, app or the Wink mod? Thanks for reporting it.
How to report it
Email us at [email protected]. For vulnerabilities on websites you can also use Open Bug Bounty (opens in a new tab).
What to include
- The affected address, or the program or app and its version
- The steps to reproduce it
- What an attacker could do with it
- A screenshot or video, if you like
You can write in English or German.
In scope
- winku.de and all its subdomains, for example smp.winku.de
- vidono.de, relvia.de and clipgrind.de
- Winku programs and Winku apps
- The Wink mod
Out of scope
- Services run by others, such as Discord, Twitch, the App Store, Google Play or our hosting providers
- briseg.eu
Please do not report
Without real consequences, these are not findings:
- Missing security headers without a demonstrable impact
- SPF, DKIM and DMARC
- Clickjacking on pages without actions
- Displayed version numbers
- Self-XSS
- CSRF on sign-out
- Results from automated scanners without proof
Rules for testing
- Only test with your own accounts.
- Do not view, change, delete or keep other people’s data. If you come across some by accident, stop and tell us.
- No load tests or DoS, no spam, no phishing and no social engineering against users or the team.
- No scanners that put noticeable load on our servers.
- Only publish the vulnerability once it is fixed, or 90 days after your report.
What we promise
- We reply within 7 days.
- We let you know as soon as it is fixed.
- If you stick to these rules, we will not take legal action against you.
Reward
There is no money. With your permission we list your name (and a link) in the Hall of Fame on this page. For serious findings you can get a small thank-you on request, such as credit in Wink.
Hall of Fame
Nobody is listed here yet. Whoever reports the first vulnerability gets the first entry.