Coordinated Vulnerability Disclosure

Not an invitation for active scanning

Our so-called Coordinated Vulnerability Disclosure policy is not an invitation to actively scan our network or systems for vulnerabilities. We carry out our own monitoring of our organisation’s network. As a result, there is a good chance that we will pick up your scan, that Saxion Security Operations Centre (SOC) will conduct an investigation, which may lead to unnecessary costs.

Criminal prosecution

It is possible that during your own investigation you perform actions that are punishable under criminal law. If you have complied with the conditions below, we will not take legal action against you. However, the Public Prosecutor's Office maintains the right to decide whether to prosecute you.

What do we want you to do?

• Mail your findings to soc@saxion.nl. Encrypt your findings with our PGP key to prevent the information from falling into the wrong hands.
• Do not exploit the vulnerability found by downloading more data than necessary to demonstrate the vulnerability nor change nor delete the data.
• Do not share the vulnerability with others until the vulnerability has been fixed.
• Do not use attacks on physical security or third-party applications, social engineering, (distributed) denial-of-service, malware, or spam.
• Please provide us with enough information to reproduce the vulnerability so that we can fix it as quickly as possible.

What we promise you:

• We will respond to a report within 5 working days, give our assessment and say when we expect to have the vulnerability fixed;
• We will treat the report confidentially and will not share the details of the reporter with third parties without the explicit permission of the reporter, unless this is necessary to comply with our legal obligations;
• We would like to thank you for reporting a vulnerability in a responsible manner, by giving you a mention in our Hall of Fame.

Outside the scope

The Coordinated Vulnerability Disclosure policy only applies to Saxion University of Applied Sciences’ own systems and only to real vulnerabilities. Therefore, certain reports are outside its scope. Trivial vulnerabilities or bugs that cannot be exploited are not eligible for being included in the Hall of Fame. Below are examples of known vulnerabilities and accepted risks that fall outside the scope of the Coordinated Vulnerability Disclosure policy: