Security policy

Last updated 27 October 2026. Nederlandse versie

Coordinated vulnerability disclosure

We take the security of our systems seriously. If you find a vulnerability in one of them, we would like to hear about it, so that we can fix it. This policy follows the Dutch NCSC guideline for coordinated vulnerability disclosure.

Scope

• accretus.nl and its subdomains, and the services Accretus runs there.
• Out of scope: systems of third parties, including our hosting, DNS and mail providers. Report issues in their systems to them directly.

How to report

• Email security.txt@accretus.nl. Please encrypt sensitive details with our OpenPGP key: gpg.txt, fingerprint 1616 BCF3 AF9C 73BB 87F3 9614 018B F37F E1BD 1372.
• Describe the problem and how to reproduce it: the URL or system, the steps, and the impact you expect. A proof of concept helps.
• Leave a way to reach you, an email address or phone number. You may report anonymously, but then we cannot keep you informed.
• English or Dutch.

Please do

• Report the vulnerability as soon as possible after you find it.
• Do no more than needed to show the problem. Stop as soon as you have shown it.
• If you reach personal or confidential data, do not copy, change or delete it. Stop, and tell us what you saw.
• Keep the problem confidential until it is fixed, and agree with us on any publication.

Please do not

• Run denial-of-service or load tests, or use automated scanners at a volume that degrades the service.
• Use social engineering, phishing or spam, or attempt physical access to people or buildings.
• Install malware or backdoors, change or delete data, or change other people’s passwords or settings.
• Brute-force accounts or try more than a few passwords.
• Attack third-party systems, or exploit the problem beyond showing it.

Usually not accepted

Findings without a demonstrated security impact, such as: missing security headers with no exploit, version banners, self-XSS, clickjacking on pages without sensitive actions, SPF/DMARC remarks on domains that send no mail, or unverified output of automated tools.

What we promise

• We confirm receipt within 3 working days.
• Within 10 working days we give our assessment and an expected date for a fix, and we keep you informed of progress.
• We aim to fix the problem within 90 days, and agree with you if and how it will be published.
• If you act in good faith and within this policy, we will not take legal action against you or report you to the police. We cannot bind the Public Prosecution Service or third parties.
• We treat your report confidentially and do not share your personal details without your permission, unless the law requires it.
• If you want, we name you in our hall of fame. We have no bug bounty. For a serious, well-reported finding we may offer a small token of appreciation, at our discretion.

Looking for your next step?

We have a good network in cybersecurity and are happy to introduce talented researchers to organisations in it. Just reach out.