Report security issues

Last updated: 2026-10-26.

Have you discovered a security issue in Saga? Report it to Valhalla Systems B.V. so we can investigate it and protect users.

1. How to report a vulnerability

Email security@sagafor.me. Describe where the problem is, how we can reproduce it, and what the potential consequences are. Use examples with your own test data where possible.

Do not send passwords, access codes, or personal data of others. Is sensitive information needed to investigate the report? Ask us first how you can provide it securely.

For regular errors or support questions, you can contact support@sagafor.me.

2. Careful investigation

These terms apply to sagafor.me, app.sagafor.me, the Saga API, and the official Saga Android app. They do not grant permission to test systems or accounts of users, employees, or suppliers. If in doubt, first ask whether a system falls under these terms.

• Use your own accounts and data. Collect only the evidence necessary to demonstrate the problem.
• Stop as soon as you notice that you can access data or accounts of others. Report this immediately, without further searching or copying data.
• Do not modify or delete data of others and do not make it public.
• Do not disrupt the service. Do not perform overload tests and do not use spam, deception, phishing, or malicious software.
• Do not leave access credentials behind and do not use a vulnerability for your own benefit.

Have you inadvertently received personal data? Mention this in your report without sending the data. Do not keep or distribute copies and agree with us on how to securely delete them.

3. What you can expect from us

We aim to provide an acknowledgment of receipt within 5 business days and a first substantive response within 10 business days. If the investigation takes longer, we aim to provide a status update at least every 30 days.

We investigate the report and prioritize issues that may directly endanger users. We handle your report confidentially and share information only with those necessary for investigation and remediation, or when required by law.

If you act in good faith in accordance with these terms, we will not take legal action against you for that investigation. This commitment is made only on behalf of Valhalla Systems B.V.; we cannot make commitments on behalf of third parties or authorities.

Saga does not have a program with monetary rewards for reports. Any public mention of your name or alias will only occur with your consent.

4. Disclosure

Give us the opportunity to investigate and resolve the problem before you disclose it. Agree on the timing and content of publication with us, so that users do not face unnecessary risk. Never publish personal data, passwords, or access codes.

You can find the current terms on this page.