Vulnerability disclosure policy

How to report

Email info@innovablast.com with "Security" in the subject. You may write in English or Dutch. Please include:

• the product, URL, app version or API endpoint affected
• a description of the vulnerability and its impact
• the steps to reproduce it, with a proof of concept if you have one
• your name or handle, if you want credit

In scope

Innovablast B.V.'s other products follow this same policy.

• the website and web app on innovablast.com and its subdomains operated by us
• the Innovablast apps for iOS, Android, macOS and the browser, where they exist
• the APIs these apps and sites use

Out of scope

• services run by others that we only use, such as Stripe, Apple, Google, Amazon Web Services and Neon; report those to the vendor
• denial-of-service tests and load testing
• social engineering, phishing of our staff or users, and physical attacks
• spam or high-volume automated scanning
• reports without a demonstrated security impact, such as missing security headers without an exploit, clickjacking on pages without sensitive actions, self-XSS, software version disclosure, or best-practice remarks on TLS or email (SPF, DKIM, DMARC) settings

Rules for testing

• Only access, change or delete data that is your own; use test accounts.
• If you reach other people's data by accident, stop, do not copy or keep it, and tell us at once.
• Do no more than needed to show the vulnerability. Do not install backdoors, pivot, or escalate further.
• Do not disrupt the service or degrade it for other users.
• Keep the vulnerability confidential until we have fixed it, or until 90 days have passed, whichever comes first. We may ask for more time if a fix is complex, and we agree the disclosure date with you.

What we do

• We acknowledge your report within 3 working days.
• We assess it and tell you our view and the expected timeline within 10 working days.
• We fix it within these target times from confirmation: critical 7 days, high 30 days, medium 60 days, low 90 days.
• We keep you informed of progress and tell you when it is fixed.
• We credit you publicly if you want, once it is fixed.
• If a vulnerability in one of our mobile apps is being actively exploited, we report it to the authorities as the EU Cyber Resilience Act requires, and we may inform users before the 90 days end.

Safe harbour

If you act in good faith and within these rules, we will not take legal action against you, and we will not report you to the police, for the research you report to us. If a third party takes action against you, we will make it known that you acted under this policy.

This follows the Dutch guideline on coordinated vulnerability disclosure (NCSC). It cannot bind the Public Prosecution Service, which has its own policy on responsible disclosure.

No bounty

We do not pay rewards for reports.

Contact

Innovablast B.V. · Triangelweg 9, 2992 GR Barendrecht, Netherlands · Chamber of Commerce (KvK) 42043332 · VAT NL869447087B01 · info@innovablast.com

The machine-readable contact for this site is at /.well-known/security.txt.