Responsible disclosure

    Last updated:

    We do our best to keep our systems secure, but nobody is perfect. If you find a weak spot, please tell us. Then we can fix it before someone else misuses it.

    How to report it

    Report it through our contact form: the topic IT security is then already chosen. Describe what you found and how we can verify it. Our security.txt points to these arrangements.

    What we ask of you

    • Do not use the vulnerability further than needed to demonstrate it.
    • Do not view, change or delete other people's data.
    • Do not use attacks that disrupt the service, social engineering or physical access.
    • Do not share the vulnerability with others until it is fixed.

    What you can expect from us

    • We confirm your report, normally within one working day.
    • We keep you informed about the fix.
    • If you follow these rules, we will not report you to the police.
    • We thank you personally. If you like, we mention your name once the vulnerability is fixed.

    Switch on what you are happy with. You can change this any time with the "Cookie settings" link at the bottom of every page.

    Make the site and the shop work: your basket, checkout, logging in, security and remembering your cookie choice. Always on.

    Which cookies and storage?
    • Cookie choice - Remembers what you chose in the cookie banner.
      tde_consent
    • WooCommerce - The shop: your basket, checkout and order.
      woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*, store_notice*, woocommerce_recently_viewed, wc_cart_hash_*, wc_fragments_*, wc-blocks_*, wc_cart_*, storeApiCartData, storeApiCartHash, storeApiNonce
    • WordPress - Logging in to your customer account or the admin.
      wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie, wp-settings-*
    • Mollie - Payment. When you pay you go to Mollie, which uses its own cookies on its own pages. Nothing on this site.
    • Contact form - Keeps spam out of the contact form.
      tde_puzzle

    Remember small choices in your own browser: light or dark mode, calm mode, your triangle hunt progress and your best game score. Nothing is sent to us.

    Which cookies and storage?
    • Your preferences - Small choices, stored only in your browser.
      tdevo_*

    Count visits with Matomo on our own server, so we know what is useful. No advertising, no selling, no profiles across sites.

    Which cookies and storage?
    • Order source (WooCommerce) - Which page or campaign led to an order. Only with your consent.
      sbjs_*

    Videos and maps from other services (for example YouTube). They can set their own cookies when they load.

    Which cookies and storage?
    • YouTube - Videos, loaded only after you click (privacy-enhanced mode).
      set by YouTube