Have you discovered a vulnerability in our system?
We’d love to hear from you if you discover a vulnerability in MijnGBLT or another digital service. We ask that you submit a Coordinated Vulnerability Disclosure (CVD) report as soon as possible. This way, we can work together to keep our systems secure and protect customer data.
What do we expect from you?
We expect you to:
- Report the vulnerability as soon as possible after discovering it.
- Do not disclose the vulnerability or share it with others.
- Do not store, use, or distribute any data obtained, and delete it as soon as possible.
- Do not exploit the vulnerability.
- Do not install malware.
- Do not use brute-force attacks, social engineering, DoS attacks, or other techniques.
Do you meet these 6 conditions? If so, we will not file a criminal complaint and will not initiate civil proceedings.
How do you report a vulnerability?
To submit a CVD report, send us an email.
What should the report include?
In your report, include:
- Your findings and evidence of the vulnerability. We prefer to receive evidence via PGP.
- The IP address or URL of the affected system.
- A clear description of the vulnerability.
- Information that allows us to reproduce the issue.
- Any tips for resolving the issue.
- An email address or phone number where we can reach you; you may remain anonymous.
What happens after you submit a report?
You will receive an automatic confirmation of receipt within 1 business day. We will then review your report and let you know the expected resolution date. We will keep you updated on the progress throughout the process.
A financial reward may be offered for an unknown vulnerability posing a high security risk in MijnGBLT.