Vulnerability Disclosure Policy

Reporting security vulnerabilities

Report suspected security vulnerabilities to security@secudea.be.

Please include, where possible:

• the affected product, service, hostname or version;
• a description of the vulnerability;
• steps required to reproduce it;
• the potential security impact;
• relevant logs, screenshots or proof-of-concept information; and
• your preferred contact details for follow-up.

Do not include unnecessary personal data, customer data or confidential third-party information in your report.

Scope

This policy applies to:

• secudea.be;
• portal.secudea.be;
• cyrias.secudea.be;
• Secudea-developed applications and APIs;
• Secudea-developed downloadable software and tools; and
• other internet-facing services operated by Secudea.

Third-party systems and services that are not operated by Secudea are outside the scope of this policy unless explicitly identified otherwise.

Good-faith research

Secudea supports good-faith security research performed in accordance with this policy. Researchers must avoid privacy violations, data destruction, service disruption, social engineering, physical intrusion and access to data beyond what is reasonably necessary to demonstrate a vulnerability.

If sensitive or personal information is encountered accidentally, stop testing, do not retain or distribute the information and report the issue to Secudea.

Do not perform

The following activities are not authorised:

• denial-of-service or resource-exhaustion testing;
• phishing or social engineering;
• physical attacks;
• modification or deletion of data;
• accessing or downloading data belonging to other users;
• persistence or lateral movement after demonstrating a vulnerability;
• automated testing that materially affects service availability.

Response process

Secudea aims to:

• acknowledge a valid vulnerability report within 2 business days;
• perform an initial assessment within 5 business days;
• keep the reporter informed during remediation where appropriate; and
• coordinate disclosure of confirmed vulnerabilities in a manner that protects affected users.

Resolution time depends on severity, complexity and affected systems. Critical vulnerabilities are handled according to Secudea’s Vulnerability Management Policy.

Coordinated disclosure

Please allow Secudea reasonable time to investigate and remediate a vulnerability before publishing technical details. Secudea will work with reporters in good faith to agree an appropriate disclosure timeline where public disclosure is appropriate.

Legal / safe-harbour

Secudea will not intentionally pursue legal action against researchers for security research performed in good faith and in accordance with this policy. This statement does not authorise activity prohibited by applicable law and does not bind third parties.