W System / Security and vulnerability disclosure

Security and vulnerability disclosure

Security contact: [email protected] (subject "Security"). Machine-readable: /.well-known/security.txt.

How to report a vulnerability

1. Email a description, affected URL or endpoint, steps to reproduce and impact.
2. We acknowledge within 3 business days and aim to give an assessment within 10 business days.
3. We fix confirmed issues as fast as severity requires and tell you when it is fixed. We are happy to credit you if you wish.

Please act in good faith: do not access or modify other people's data, do not degrade the service (no denial-of-service or high-volume automated scanning), do not send load to the official sources behind us (VIES, HMRC, registers), and give us reasonable time to fix before public disclosure. We will not pursue legal action against good-faith research that follows these rules.

How we protect data

• HTTPS/TLS only for wsystem.dev and api.wsystem.dev; TLS for all upstream calls.
• API keys stored only as one-way hashes; secrets kept in the hosting provider's secret store, not in source code.
• No storage of users' HMRC credentials; minimal logging (see the privacy policy).
• Deletion on request via [email protected].

W System Hungary Kft.. Last updated 2026-10-17.