Found a security problem in one of our products or on this website? Please tell us. We read every report, we fix confirmed problems first, and we do not take legal action against people who report in good faith.
What this page covers
- Our software: SLUM (Smart License & Update Manager), the Custom PostNL shipping plugin for WooCommerce, and our apps Pokémon Shiny Hunter and Custom Macro Binder.
- The licence and update server for this software (the SLUM API on matrix3d.shop) and the files you download from us.
- This website, matrix3d.shop.
Problems in the services and software of other companies and projects that we use (for example payment providers, Cloudflare, WordPress, WooCommerce, Minecraft or Paper) belong with them. If such a component inside one of our products puts our users at risk, do tell us: we pass it on and protect our users in the meantime.
How to report
E-mail support@matrix3d.shop with “Security” in the subject. A person reads it. Write in English or Dutch. Please send:
- the product and its version, or the web address where you found the problem;
- what the problem is, and what an attacker could do with it;
- the steps to make it happen again, and a proof of concept if you have one;
- whether you think someone is already using it against people;
- how we can reach you, and whether you want your name in the security note when the fix is out.
We have no PGP key yet. If your report contains sensitive details, send a short first e-mail without them, and we agree on a safe way to share them.
What we do
- We confirm that we received your report within 3 working days.
- We check it and tell you what we found within 10 working days.
- We fix confirmed problems before other work. For a serious problem we aim to ship a fix within 30 days. If it takes longer, we tell you why.
- The fix reaches buyers through the normal update channel. If your licence key has expired, e-mail us and we send you the security fix free of charge. We e-mail licence holders when they need to update.
- When the fix is out, we publish a short security note in the product’s changelog, with your name if you want it there.
- We are a small company with one developer. There is no bug bounty and we do not pay for reports, but we do say thank you.
When a problem is being exploited
If a vulnerability in our software is actively exploited, or a serious incident affects the security of our products, we report it as the EU Cyber Resilience Act requires (Regulation (EU) 2024/2847, article 14). The report goes through ENISA’s single reporting platform to the Dutch coordinator, the National Cyber Security Centre (NCSC): an early warning within 24 hours, a full notification within 72 hours, and a final report later (14 days after a fix is available for a vulnerability, one month for an incident). We also tell the users of the product what happened and what they can do.
Rules for testing
If you act in good faith and follow these rules, we will not take legal action against you and we will not ask anyone else to:
- test our software only on your own installation and with your own licence key, never on other people’s servers, shops or keys;
- on matrix3d.shop and its licence API: use only your own account and your own key, test by hand, no automated scanners or load tests, and stop as soon as you can show the problem;
- do not look at, change or delete other people’s data; if you reach personal data by accident, stop, tell us, and delete it;
- no denial-of-service attacks, no spam, no social engineering, no physical attacks;
- give us time to fix the problem before you tell others: agree the date with us (we suggest the day the fix is out, and at most 90 days after your report).
These rules do not take away any right you have under the law.
No answer?
If you hear nothing from us within 10 working days, you can also report the problem to the NCSC, the Dutch coordinator for vulnerability reports: ncsc.nl/contact.
For tools: /.well-known/security.txt. Last updated: 24 October 2026.