Responsible Disclosure

Responsible Disclosure Policy

Responsible Disclosure Policy BIT B.V. – Version 2018-12-31

At BIT, we consider the security of our systems very important, but despite our efforts to ensure security, there may still be a weak spot. If you discover a weakness in our of our systems, we would like to hear about it so that we can take action as soon as possible. We want to work with you to better protect both our customers and our systems. Our Responsible Disclosure is also available in pdf format.

BIT’s infrastructure is also used by third-party systems and in many cases managed by those third parties. Weaknesses in systems managed by third parties are not covered by this Responsible Disclosure Policy. Systems not covered by this policy have a hostname that includes vm.bit.nl, colo.bit.nl or customer.bit.nl. You may nevertheless report systems with such hostnames. If you do so, you agree in advance that your report will be forwarded uncensored to the administrator of the system in question. In such cases, the promises made by BIT below no longer apply.

We ask you:

Not to use physical security attacks, social engineering, distributed denial of service, spam or automated tools, such as vulnerability scanners.
Not to abuse the problem by, for example, downloading more data than necessary to prove the leak, or viewing, deleting or modifying third-party data.
Not to share the problem with others until it is resolved.
To email your findings to cert@bit.nl. Encrypt your findings with our PGP key (found at the bottom of this page) to keep sensitive information out of the wrong hands.
To provide sufficient information so that we can reproduce the problem as soon as possible. This way we can solve the problem as soon as possible. Usually, the IP address or URL of the affected system and a description of the vulnerability is enough, but for more complex vulnerabilities additional information may be required.
To delete all data obtained through the leak.

We promise:

If you comply with the above conditions, we will not take any legal action against you as the result of the report.
We will respond to your report within three business days with our assessment and an estimated date for resolution.
We will keep you updated on the status of the resolution.
We will treat your report confidentially and will not disclose your personal information to third parties without your consent, unless required by law.
It is possible to report under a pseudonym.
In all communications regarding the reported problem, we will identify you as the reported, if you so wish.

We strive to solve all problems as quickly as possible and are happy to be involved in any publication about the problem after it is solved.

The above text is based on the work of Floor Terra as published a https://www.responsibledisclosure.nl.

The modified text is published under the Creative Commons Attribution 3.0 license.

PGP-key