Route443 designs, monitors and tests the security of other organisations. Our own environment should therefore withstand scrutiny, and a report of a vulnerability should be welcome. Have you found a weakness in a system, website or service of Route443? Please tell us. This page explains how, and what you can expect from us.

How to report a vulnerability

  • Email security@route443.eu. If you prefer encrypted mail, ask us for our public key first.
  • Describe what you found, where, and how we can reproduce it. A short step-by-step description or a screenshot is enough; a working exploit is not required.
  • Leave a name or alias so we can reach you. Anonymous reports are welcome too, but we will not be able to give you feedback.

The machine-readable version of this information is available at /.well-known/security.txt.

What we ask of you

  • Do not go further than necessary to demonstrate the vulnerability. Do not view, copy, modify or delete data belonging to us or to our customers.
  • No denial-of-service attacks, no social engineering, no physical access and no spam.
  • Do not install backdoors, not even "as proof". Remove anything you placed as soon as the proof has been delivered.
  • Do not share the finding with others or publish it before we have fixed the issue and agreed on disclosure with you.
  • Report as soon as possible after discovery.

What you can expect from us

  • An acknowledgement and a point of contact within one working day.
  • An initial assessment within five working days: whether it is valid, how severe it is and what we will do.
  • We keep you informed and aim to fix a confirmed vulnerability within 30 days. If it takes longer, we will explain why.
  • We treat your report and your details confidentially and do not share them with third parties without your consent, unless the law requires us to.
  • If you act in accordance with these terms, we will not take legal action against you. This policy follows the Coordinated Vulnerability Disclosure guideline of the Dutch NCSC.
  • If you wish, we will list your name or alias below as a thank-you. We do not pay bounties, but we are happy to send a small token of appreciation for a valid report.

Out of scope

We will review the following, but generally do not consider them vulnerabilities:

  • missing best-practice headers or settings without demonstrable impact (such as SPF, DMARC or CSP findings without working abuse);
  • output of automated scanners without manual verification;
  • vulnerabilities in third-party systems we do not control; please report those to the party concerned;
  • social engineering of employees or suppliers, and physical access to our premises;
  • anything affecting our customers: customer environments fall under the customer's own CVD policy.

Acknowledgments

We thank the reporters who have helped us make our environment safer. Let us know in your report if you would like to be listed.

No acknowledgments yet.

Questions about this policy? Email security@route443.eu.