Responsible disclosure.
Found a vulnerability in a Sebsoft system? Email helpdesk@sebsoft.nl. Read how to report it safely and what to expect from us.
With an estimated date for a solution, not a fixed resolution deadline.
Report a vulnerability
Even well-protected systems can have vulnerabilities. If you find a security issue in a Sebsoft system, please tell us so we can investigate it and protect our customers.
Email your findings to helpdesk@sebsoft.nl. Include the affected URL or IP address, a description of the issue and enough detail for us to reproduce it. More complex issues may need further explanation.
Testing boundaries
- Do not exploit the issue beyond what is needed to demonstrate it. Do not download more data than necessary, or change or delete anyone else's data.
- Do not disclose the issue to others before it has been resolved. Please coordinate any eventual publication with us after a fix.
- Do not attack physical security, use social engineering, launch distributed denial-of-service attacks, send spam or test third-party applications.
What you can expect
- Within 10 working days, we will respond with our assessment of the report and an expected date for remediation. This is an estimate, not a guarantee that the issue will be resolved by that date.
- If you follow the rules above, we will not take legal action against you in connection with your report.
- We will treat your report confidentially and will not share your personal details with third parties without your permission.
- We will keep you informed about progress in addressing the issue.
We aim to resolve reported issues as soon as we can. At our discretion, we may offer a reward for a report that qualifies under our internal vulnerability classification. Whether a reward is offered, and its amount, depend on the severity of the issue and the quality of the report. A reward is not guaranteed.