Vulnerability Disclosure Policy

Last updated: 27 October 2026

SecureHabits (KVK 78029260, Willemspoort 102, 5223 WV Den Bosch, Netherlands) welcomes reports of vulnerabilities in its website and tools. This policy follows the coordinated vulnerability disclosure (CVD) template in ENISA’s draft technical advisory on security.txt, CVD policies, and security advisories.

Scope

In scope

• the website www.securehabits.nl
• files we publish for download on the website, such as the Docker Compose file in our Dependency-Track guide

Out of scope

• third-party services this website uses, such as our CRM, chat, analytics, and booking providers, our hosting and DNS providers, and embedded LinkedIn and YouTube content. Please report issues in those services to the provider. If you are not sure who is responsible, report to us, and we will pass it on.
• scanner output without a demonstrated, exploitable impact, for example missing HTTP security headers or email records, version banners, or clickjacking on pages without sensitive actions
• products of our clients or of other vendors that we review in our work. Please report those to the vendor concerned.

How to report

Email [email protected], in English or Dutch. This address is also listed in our security.txt file.

We do not currently publish a PGP key. Encryption is not required to report. If your report contains sensitive details, such as working exploit code, say so in your first message and we will agree on a secure way to exchange them.

Please include the following in your report:

• the type of vulnerability, such as its CWE
• the affected URL, page, or file
• the steps to reproduce it
• a proof of concept, such as screenshots, HTTP requests and responses, or a short script
• the impact as you see it
• the date of discovery and, where relevant, the IP addresses you tested from
• how we can reach you; a name or pseudonym is optional

Please do not include personal data of others in your report unless it is strictly needed to show the issue.

Rules for testing

When you investigate a possible vulnerability, please follow these rules.

• Do only what is necessary to demonstrate the vulnerability.
• Do not access, change, or delete data that does not belong to you. If you reach someone else’s data by accident, stop, tell us, and delete your copy.
• Do not conduct denial-of-service tests, high-rate automated scans, spam, social engineering, or physical attacks.
• Keep the details confidential until we have fixed the issue or agreed on disclosure with you.

What you can expect from us

Step	Our commitment
Acknowledgment of your report	Within 3 business days
Initial assessment and severity	Within 10 business days
Status updates	At least every 2 weeks until the report is closed
Fix or mitigation	As soon as possible, and within 90 days of acknowledgment for confirmed vulnerabilities, sooner for serious ones

We will communicate with you through the contact details you give us, and tell you when the issue is fixed. If a fix takes longer than planned, we will explain why and agree on a new timeline with you.

Coordinated disclosure

We ask you not to publish details of a vulnerability until it is fixed, or until 90 days after we acknowledged your report, whichever comes first. We are happy to agree on a different date with you, for example when a fix is complex or ready sooner.

Where a vulnerability lies in a third-party service or component, we may share the details with the provider or maintainer so they can fix it, and involve them in the coordination.

Safe harbor

We will not take legal action against you, or ask others to, for research that follows this policy in good faith: testing only what is in scope, respecting the rules for testing, and reporting to us before telling anyone else. We consider such research authorized.

This statement covers only our own systems and claims we can waive ourselves. It cannot authorize testing of systems owned by others, such as the third-party services listed above, and it does not change any legal obligation.

Recognition

We do not run a bug bounty and do not pay for reports. With your permission, we are glad to thank you by name or handle once the issue is resolved.

Privacy

We use your contact details only to handle your report and to keep you informed. We do not share them with others without your consent, unless the law requires it. Our Privacy Policy explains how we process personal data.

Changes to this policy

This is version 1.0, in force from 27 October 2026. We review this policy at least once a year and show the date of the last change at the top of this page.