How we protect the site
Payments run on Stripe Checkout. Card details go straight to Stripe and never reach our servers.
Passwords are stored only as strong one-way hashes, never as plain text. Sign-in attempts are limited, and new accounts and email changes are confirmed with a code we email.
Agency and partner accounts can only change their own listings, and only through their dashboard, which checks every change. The admin area is closed to them.
Every form is protected against spam and abuse with rate limits and Cloudflare Turnstile, without saving your IP address. The whole site is served over an encrypted connection, with security headers that stop other sites from framing it.
We collect as little as we can: no analytics, advertising or tracking, messages to us aren’t stored on the site, and old data is deleted on a schedule set out in our Privacy Policy.
Report a vulnerability
Email us in English or Swedish. Tell us what you found, the page or address it affects, the steps to reproduce it and what an attacker could do with it. Screenshots or a short video help.
We confirm we got your report within 3 working days, keep you updated while we fix it, and tell you when it’s fixed. Please give us 90 days to fix the problem before you tell anyone else about it.
Rules for testing
Test only with accounts you create yourself, and stop as soon as you reach data that isn’t yours. Don’t keep, change or share it.
Don’t run denial-of-service or load tests, automated scans that send many requests, phishing or other social engineering against our team or agencies, or physical attacks. Don’t send messages through agencies’ contact forms or post reviews to test: they reach real businesses.
Stripe, Cloudflare and Google run their own security programmes. Report problems in their services to them.
Safe harbour
If you follow these rules and act in good faith, we consider your research authorised. We won’t take legal action against you or report you to the police for it, and if someone else does, we’ll make it known that you acted within this policy.
Out of scope
Reports without a realistic attack: missing headers or email records with no shown impact, software version numbers, clickjacking on pages without sensitive actions, attacks that need a stolen device or an account that is already compromised, and the output of automated scanners without a working proof.
Rewards
We don’t pay bounties. If you report a real problem, we’ll thank you by name on this page if you’d like, with a link of your choice.