1. How do I report a vulnerability?
Send your report to security@buzzterz.be. Preferably encrypt sensitive information with our public PGP key. Include in your report:
- which component is affected (for example a URL or form);
- a description of the issue and its possible impact;
- the steps to reproduce the issue;
- how we can contact you (anonymous reports are welcome too).
2. Ground rules
For your report to fall under this policy, we ask you to:
- do only what is needed to demonstrate the issue, and go no further;
- not view, copy, change or delete other people's data, and delete any data obtained by accident straight away;
- not carry out attacks that disrupt the service (such as overloading), not attempt social engineering, phishing or physical access, and not send spam through the forms;
- not install malware or backdoors;
- not share the vulnerability with third parties or make it public before it is fixed, or at the latest 90 days after your report in consultation with us;
- act in good faith, without financial or other demands.
3. Scope
This policy covers buzzterz.be and its subdomains. Our suppliers' systems (hosting, email, payment services, address services) are not included; report issues there directly to the party concerned.
4. What can you expect from us?
- We confirm your report within 5 working days and keep you informed of the follow-up.
- We aim to fix the issue as quickly as possible, depending on its severity.
- We treat your report and your data confidentially and do not pass them on without your consent, unless the law requires us to.
- If you follow the ground rules above, we will not take legal action over your research.
- If you wish, we'll credit you by name once the issue is fixed.
Buzzterz is a small business and does not offer a monetary reward (bug bounty).
5. Reporting to the CCB
You can also report a vulnerability to the Centre for Cybersecurity Belgium, which acts as the national coordinator for vulnerabilities, via ccb.belgium.be. Under certain conditions, the Belgian legal framework for coordinated disclosure protects anyone who investigates and reports a vulnerability in good faith.
General questions about your personal data? Read our privacy policy.