Responsible disclosure.

We do our best to keep our website secure. Still, it may have a weak spot. If you find a vulnerability, we would like to hear about it as soon as possible, so we can fix it before anyone abuses it.

With this policy, we give you permission to investigate our website, within the scope and the rules below. If you stick to them, we consider your research authorised.

In scope

• The website https://ginkgo-leaf.eu, including all pages and documents on it.

Out of scope

• Third-party services we use, such as GitLab (hosting), Proton Mail (e-mail), Let’s Peppol (e-invoicing) and our bank. If you find something there, please report it to that provider directly.
• The systems of our clients and partners.
• Our devices, accounts and premises.
• Ourselves and our clients: no social engineering or phishing.

We are happy to read reports without a demonstrable risk, but they are not eligible for a reward. Think of missing HTTP security headers, SPF, DKIM or DMARC settings, version disclosure, clickjacking on pages without sensitive actions and raw output from automated scanners.

• Do no more than needed to demonstrate the problem. Stop as soon as you have a proof of concept.
• Do not look at more data than necessary, and do not download, change or delete any data.
• If you come across personal data, stop, copy nothing and delete what you saw once your report has been sent.
• No denial of service, load testing or brute force.
• No social engineering, phishing, spam or physical access.
• Do not install anything on our systems: no malware, no backdoor and no other way to get back in later.
• Do not share the access you found with anyone: do not pass on passwords, links or your method. Those details go only to us (and, if applicable, to the CCB).
• Do not disclose the vulnerability publicly before it is fixed and we have agreed on a date together.
• Do not ask for money in exchange for details or for your silence. That is no longer responsible disclosure.

E-mail your report to security@ginkgo-leaf.eu.

Encrypt your report with our public PGP key. If you send it from Proton Mail, this happens automatically. Use a neutral subject line, because the subject is not encrypted.

Please include:

1. what the problem is and where (URL);
2. the steps to reproduce it;
3. your evidence, as limited as possible and with personal data made unreadable;
4. the possible impact, and what you did not do;
5. when you tested (date, time and time zone) and from which IP address;
6. how we can reach you. An alias is fine.

You can write in Dutch or English.

• We confirm your report within five working days, with an initial assessment.
• We keep you informed. Our goal is a fix within 90 days.
• We treat your report confidentially and do not share your details without your consent, unless the law requires us to.
• If you followed the rules, we will not report you to the police or take legal action against you.
• After the fix, we agree together whether and when the vulnerability is disclosed. If you wish, we credit you by name or alias as the finder.

If you are the first to report a new vulnerability within this policy and you followed the rules, you get a Ginkgo Leaf t-shirt. One t-shirt per vulnerability. We decide whether a report qualifies. We do not pay money: this is not a bug bounty.

If you like, we will also add you to our hall of fame.

Accessing a computer system without permission is a criminal offence in Belgium, even with good intentions. This policy is that permission, but only within the scope and the rules above. It does not authorise testing of third-party systems.

You can also follow the legal procedure of the Centre for Cybersecurity Belgium (CCB), based on articles 22 and 23 of the Belgian NIS2 Act of 26 April 2024. You then report to the CCB (vulnerabilityreport@ccb.belgium.be) and to us: a simplified notification within 24 hours of the discovery and a full notification within 72 hours. Publication is then only allowed with the CCB’s agreement.

More from the CCB: the legal framework and reporting a vulnerability.

These researchers helped us become more secure.

No one yet. Will you be the first?

This policy is based on the example policy by Floor Terra, published under CC BY 4.0, and adapted to the Belgian framework. A machine-readable version is in security.txt.