# Security policy | Buzzterz

> Buzzterz's coordinated vulnerability disclosure (CVD) policy: how to report a security issue and what you can expect from us.

Source: https://buzzterz.be/en/security.html

Version: 19 October 2026

# Security policy

Buzzterz takes the security of its website and its customers' data seriously. Found a weakness anyway? Report it to us and we'll fix it together. This policy follows the coordinated vulnerability disclosure (CVD) guidelines of the Centre for Cybersecurity Belgium (CCB).

- [Report](https://buzzterz.be/en/security.html#melden)
- [Ground rules](https://buzzterz.be/en/security.html#regels)
- [Scope](https://buzzterz.be/en/security.html#scope)
- [Our commitments](https://buzzterz.be/en/security.html#beloften)
- [Report to the CCB](https://buzzterz.be/en/security.html#ccb)

## 1. How do I report a vulnerability?

Send your report to [security@buzzterz.be](mailto:security@buzzterz.be). Preferably encrypt sensitive information with our [public PGP key](https://buzzterz.be/.well-known/pgp-key.txt). Include in your report:

- which component is affected (for example a URL or form);
- a description of the issue and its possible impact;
- the steps to reproduce the issue;
- how we can contact you (anonymous reports are welcome too).

## 2. Ground rules

For your report to fall under this policy, we ask you to:

- do only what is needed to demonstrate the issue, and go no further;
- not view, copy, change or delete other people's data, and delete any data obtained by accident straight away;
- not carry out attacks that disrupt the service (such as overloading), not attempt social engineering, phishing or physical access, and not send spam through the forms;
- not install malware or backdoors;
- not share the vulnerability with third parties or make it public before it is fixed, or at the latest 90 days after your report in consultation with us;
- act in good faith, without financial or other demands.

## 3. Scope

This policy covers **buzzterz.be** and its subdomains. Our suppliers' systems (hosting, email, payment services, address services) are not included; report issues there directly to the party concerned.

## 4. What can you expect from us?

- We confirm your report within **5 working days** and keep you informed of the follow-up.
- We aim to fix the issue as quickly as possible, depending on its severity.
- We treat your report and your data confidentially and do not pass them on without your consent, unless the law requires us to.
- If you follow the ground rules above, we will not take legal action over your research.
- If you wish, we'll credit you by name once the issue is fixed.

Buzzterz is a small business and does not offer a monetary reward (bug bounty).

## 5. Reporting to the CCB

You can also report a vulnerability to the Centre for Cybersecurity Belgium, which acts as the national coordinator for vulnerabilities, via [ccb.belgium.be](https://ccb.belgium.be). Under certain conditions, the Belgian legal framework for coordinated disclosure protects anyone who investigates and reports a vulnerability in good faith.

General questions about your personal data? Read our [privacy policy](https://buzzterz.be/en/privacy.html).