At Van Meijel, the security of our systems, our software and our customers' data matters to us. Despite our efforts, a vulnerability may still occur in our systems or products. If you discover one, we would like to hear about it, so that we can resolve the issue together as quickly as possible. This is known as Coordinated Vulnerability Disclosure (CVD), also called responsible disclosure.

We appreciate the efforts of security researchers and users who help us improve our security in a responsible manner.

What we ask of you

Report the vulnerability as soon as possible after discovery, using the contact details below.
Provide enough information to reproduce the issue, so that we can assess and resolve it quickly. In most cases the IP address or URL of the affected system and a description of the vulnerability will do; complex vulnerabilities may require more detail.
Treat the vulnerability as confidential: do not share the information with others and do not disclose it until the issue has been resolved and we have agreed on disclosure together.
Do not exploit the vulnerability beyond what is strictly necessary to demonstrate it, and do not do anything that could cause damage.

Act proportionately. Specifically, do not:

view, copy, modify or delete third-party data (do not download more than needed to demonstrate the vulnerability; stop after one record, for example);
affect the availability or operation of our systems, for instance through a (Distributed) Denial-of-Service ((D)DoS) attack, spam, or mass account creation;
use social engineering, phishing or physical intrusion;
install malware, backdoors or other malicious software;
run automated scanners or brute-force techniques that could disrupt our services;
make changes to the system, or share or sell access to third parties.

Scope

This policy applies to systems, services and products managed and developed by Van Meijel and Maxedy, including:

the websites and online services we manage under vanmeijel.nl and maxedy.com (including subdomains);
our software products, including Metacom and BizzStream, insofar as supplied and managed by Van Meijel/Maxedy.

Out of scope (do not test these, or contact us first):

systems, hosting or installations managed by or on behalf of a customer (on-premise or in the customer's own cloud environment); report these to the customer concerned, or to us if in doubt;
third-party services and products (suppliers, integration partners, hosting providers) not managed by us;
vulnerabilities that rely solely on outdated browsers, software or configurations on the user's side;
reports without a concrete security risk, such as missing best-practice headers without demonstrable impact, or purely theoretical risks.

Not sure whether something is in scope? Feel free to contact us first.

How to report a vulnerability

E-mail: security@vanmeijel.nl
Machine-readable: see https://www.vanmeijel.nl/.well-known/security.txt
Encrypted reporting: for sensitive reports, please use our PGP key, published at https://www.vanmeijel.nl/.well-known/pgp-key.txt.

Please include at least:

a description of the vulnerability and its potential impact;
the steps to reproduce it (URL/IP, request, screenshots or proof of concept);
your contact details, so that we can respond (anonymous reports are accepted, but we will then be unable to follow up or credit you).

What you can expect from us

We will confirm receipt of your report within 3 business days.
Within 10 business days you will receive our assessment of the report and, where possible, an expected timeline for resolution.
We will keep you informed of our progress.
We will treat your report confidentially and will not share your personal data with third parties without your consent, unless required by law.
We aim to resolve and disclose the vulnerability in mutual consultation. As a guideline we apply a period of 60 days between the report and public disclosure; this may be extended by mutual agreement (for example for complex vulnerabilities or third-party dependencies).
After consultation, and once the vulnerability has been resolved, you may publish about it in coordination with us.

Recognition

We do not offer monetary rewards (bug bounty). We do value your contribution.

No legal action for good-faith reports (safe harbor)

If you comply with the conditions above and act in good faith, we will not report you to the authorities or take legal action against you in connection with your report. In that case we will not regard your actions as a criminal offence or a breach of our terms.

This commitment does not apply in cases of malicious intent, disproportionate actions, or violation of the rules above (such as exfiltrating or publishing data, or disrupting our services). In those cases we reserve all rights. This policy does not provide indemnity for offences unrelated to researching and reporting a vulnerability in good faith.

This policy follows the Dutch CVD practice, including the NCSC guideline on Coordinated Vulnerability Disclosure.