Responsible vulnerability disclosure
The security of users and data is crucial. Below you will find instructions on how to report vulnerabilities to us safely, without fear of legal consequences.
We use real data solely to verify and fix bugs.
Email the security teamSend all reports to security@ebusi.si. Include a description of the vulnerability, steps to reproduce and the expected impact.
Send a messageIf your report contains sensitive data, use the PGP key (Curve25519) published in the security.txt file.
Download the keyWe acknowledge receipt within three working days. We keep you informed of the progress of the fix in the same email thread.
Vulnerabilities in scope:
- All production and test environments on the *.ebusi.si domain, including the APIs and the PWA.
- Vulnerabilities that expose personal data, enable unauthorised access or allow GTFS data to be modified.
- APIs and integrations that we provide to the municipality or the public (e.g. /api/vehicles).
Out of scope (no rewards or recognition):
- DoS/DDoS attacks, brute-force attacks and automated load testing.
- Social engineering, phishing or physical access to devices belonging to third parties.
- Bugs originating in third-party providers' services (e.g. MapLibre, Google Workspace).
Test on your own accounts and use minimal data sets. Do not collect or transfer users' personal data, and avoid making changes to production databases.
If you discover a critical vulnerability, coordinate with us before public disclosure. In return, we offer transparency and – if you wish – public acknowledgement.
Response process
1. Prepare a secure report
Description, impact, screenshots and logs. Use PGP if necessary, and test on your own accounts.
2. Acknowledgement and analysis
Within three days, we acknowledge receipt and reproduce the vulnerability internally. We agree on a realistic deadline for the fix.
3. Fix and feedback
After a successful fix, we will notify you and – if you wish – gladly include your name in our acknowledgements.
Safe harbour
Legal protection for researchers
If you comply with this policy and do not exceed its scope, we will not initiate legal proceedings. Our goal is safer public transport for all users.