Security
Report a vulnerability and what you can expect from us
If you have found a security issue in Telenoa, we want to hear about it. This page explains how to report it, what you may test and what we promise you.
How to report
Write to security@telenoa.com, ideally with “Vulnerability” in the subject line. Danish or English is fine. Tell us:
- What you found, and which address or feature it affects.
- How we can reproduce it, step by step.
- What an attacker could achieve with it.
- How we can reach you if we have questions.
What we promise
- We confirm that we have received your report within 5 working days.
- We tell you whether we can reproduce the issue and keep you updated while we fix it.
- We let you know when the issue is fixed.
What you may test
- app.telenoa.com and www.telenoa.com, including the app's API, contact forms and widgets.
- Use your own account or a test company. If you need a test account, write to us.
Out of scope
- Attacks meant to take the service down or slow it down (DoS and DDoS), and load testing.
- Social engineering, such as phishing against us, our customers or their customers.
- Physical attacks against our equipment or data centres.
- Issues at our vendors (such as Stripe, Telnyx or Cloudflare). Report those to the vendor.
- Spam and high volumes of calls to Noa Voice or to customers' forms.
- Automated scans without a demonstrated issue, and missing security headers or similar without a concrete impact.
Rules for testing
- Do not view, change or delete other people's data. If you come across personal data, stop, do not keep it, and tell us.
- Do not go further than needed to demonstrate the issue.
- Do not disrupt the service or other users.
- Do not tell others about the issue before it is fixed, and agree the timing with us.
Safe harbour
- If you test in good faith and follow the rules on this page, we will not take legal action against you or report you to the police.
- If another party takes legal action because of your testing, we will make it clear that you followed these rules.
- If you are unsure whether something is allowed, ask us before you test.
No bounties
- We do not run a bug bounty programme and do not pay for findings. We are grateful for every report.