Security
Responsible disclosure policy
If you believe you’ve found a security vulnerability in AISec or on this website, please tell us. We’ll work with you to understand and fix it.
How to report
Email security@aisec.design. Please include:
- what you found and where (URL, component or endpoint);
- steps to reproduce, or a proof of concept;
- the impact as you understand it;
- how you’d like to be credited, if at all.
Write in English or Dutch. If your report contains sensitive details, ask us for an encrypted channel first.
What you can expect from us
- An acknowledgement within 3 working days.
- An initial assessment within 10 working days, and updates as we work on a fix.
- A fix or mitigation as quickly as the severity requires. We aim to resolve issues within 90 days and will agree a disclosure date with you.
- Public credit for your finding once it’s fixed, if you want it.
Safe harbour
We won’t take legal action against, or ask law enforcement to investigate, anyone who reports a vulnerability in good faith and in line with this policy. This policy follows the spirit of the Dutch National Cyber Security Centre’s guideline on coordinated vulnerability disclosure.
Please do
- Report the issue as soon as possible after you find it.
- Use only the access needed to show the problem, and stop once you’ve shown it.
- Keep the details confidential until we’ve fixed the issue and agreed on disclosure.
Please don’t
- Access, change or delete data that isn’t yours, or keep it longer than necessary.
- Run denial-of-service tests, spam, or social engineering against us or our customers.
- Use physical attacks, or attack our suppliers’ or customers’ systems.
- Install malware or backdoors, or use automated scanners that generate heavy traffic.
Scope
In scope: aisec.design and AISec services we operate. Out of scope: findings without
a security impact, such as missing best-practice headers on non-sensitive pages, reports from automated
tools without a working proof, and issues in third-party services we don’t control.
Rewards
We don’t run a paid bug bounty yet. We’re a young company, but we’re grateful for every report and will gladly credit you.