Coordinated Vulnerability Disclosure Policy

At Axxemble, we take the security of our systems, applications, and services seriously. Despite our efforts to maintain a secure environment, security vulnerabilities may occasionally be discovered.

We encourage security researchers, ethical hackers, and other individuals who identify potential vulnerabilities in our systems, including BaseFortify.eu, to report them responsibly.

Our Coordinated Vulnerability Disclosure (CVD) Policy, also known as Responsible Disclosure, explains how to report security vulnerabilities, what we expect from researchers, and how we handle submitted reports.

1. How to Report a Security Vulnerability

If you discover a potential security vulnerability affecting an Axxemble system or service, please contact our security team.

• Email: security@axxemble.nl
• Encrypted communication: You can use our public PGP key to encrypt sensitive vulnerability reports.
• Telephone: +31 (0)85 303 8429

To help us investigate the issue efficiently, please include as much relevant information as reasonably possible:

• A description of the vulnerability and its potential security impact.
• The affected application, system, URL, or endpoint.
• Steps required to reproduce the vulnerability.
• Relevant technical evidence, such as screenshots, HTTP requests, or sanitized log entries.
• Any recommendations you may have for mitigating or resolving the issue.

Please avoid including unnecessary personal data, passwords, access tokens, or other sensitive information in your report.

2. Guidelines for Security Researchers

We appreciate responsible security research and ask that you follow these guidelines when investigating potential vulnerabilities:

• Act responsibly: Conduct your research in a manner that minimizes risks to our systems, users, and services.
• Avoid disruption: Do not perform denial-of-service attacks, destructive testing, or activities that could affect service availability.
• Respect privacy: Do not intentionally access, download, modify, or disclose information belonging to other users.
• Limit exploitation: Do not exploit a vulnerability beyond what is reasonably necessary to demonstrate its existence and impact.
• Do not establish persistence: Avoid installing backdoors, malware, or other mechanisms that provide continued unauthorized access.
• Protect confidential information: Do not share vulnerability details or confidential information with unauthorized third parties.
• Coordinate disclosure: Allow us a reasonable opportunity to investigate and address the vulnerability before publishing technical details.
• Remove collected information: Securely delete confidential information obtained during testing as soon as it is no longer necessary for reporting or verification.

If you are uncertain whether a particular testing activity is permitted, please contact us before proceeding.

3. Vulnerabilities Outside the Scope of This Policy

Not every security observation represents an exploitable vulnerability. The following categories are generally excluded from this disclosure policy unless a demonstrable security impact can be established:

• Reports concerning rate limiting on application endpoints without evidence of a meaningful security impact.
• Reports of excessive email generation or mail flooding without demonstrated security consequences.
• Automatic hyperlink formatting performed by email clients when the original message did not contain a hyperlink.
• Brute-force or account-lockout observations on login or password recovery pages without evidence of a practical security vulnerability.
• Missing MTA-STS configuration without evidence of an exploitable security weakness.
• Automated vulnerability scanner results that have not been verified and do not demonstrate an actual security issue.

We reserve the right to assess reports individually. Findings that demonstrate a significant security impact may still be considered even when they fall within one of the categories above.

4. How We Handle Vulnerability Reports

We aim to handle all legitimate vulnerability reports professionally, confidentially, and without unnecessary delay.

Our disclosure process includes the following steps:

• Acknowledgment: We will respond to your initial report within three working days.
• Initial assessment: We will evaluate the reported vulnerability and, where possible, provide an indication of its severity and an expected resolution timeline.
• Further investigation: We may contact you to request additional technical details or assistance in reproducing the issue.
• Remediation: We will investigate appropriate corrective measures and aim to resolve confirmed vulnerabilities as quickly as reasonably possible.
• Progress updates: We will keep you informed of relevant developments during the investigation and remediation process.
• Coordinated publication: Where appropriate, we will coordinate the public disclosure of vulnerability details after remediation or suitable mitigation measures have been implemented.

Resolution times depend on the severity, complexity, and potential impact of the vulnerability. Some issues may require additional investigation or coordination with external parties.

5. Third-Party Systems and Services

Some Axxemble products and services rely on external technology providers or third-party infrastructure.

If a reported vulnerability primarily affects a third-party service, we may forward the relevant technical information to the responsible provider or coordinate with that organization to facilitate remediation.

Any rewards offered by third parties are subject to their own vulnerability disclosure policies and are not guaranteed by Axxemble.

6. Confidentiality and Researcher Recognition

We treat vulnerability reports confidentially and handle personal information in accordance with applicable data protection requirements.

• We will not publicly disclose your identity without your permission.
• We may share relevant technical details with parties directly involved in investigating or resolving the vulnerability.
• Personal information will only be shared where necessary and permitted by applicable law.
• If you wish, we can acknowledge your contribution when publishing information about the resolved vulnerability.

We value the contributions of security researchers and recognize the importance of responsible vulnerability disclosure in improving cybersecurity.

7. Rewards for Responsible Disclosure

As a token of appreciation, Axxemble offers rewards for qualifying reports of previously unknown security vulnerabilities.

The nature and value of a reward are determined by Axxemble and may depend on factors such as:

• The severity and potential impact of the vulnerability.
• The quality and completeness of the submitted report.
• The relevance of the vulnerability to systems managed by Axxemble.
• Whether the vulnerability was previously known or already reported.

When multiple researchers independently report the same vulnerability, priority for any reward will generally be given to the first valid report received.

Axxemble determines whether reports concern the same underlying vulnerability and does not disclose confidential information about other submissions.

Rewards are discretionary, and submitting a report does not automatically guarantee compensation.

8. Legal Considerations and Safe Harbor

Axxemble supports good-faith security research conducted in accordance with this Coordinated Vulnerability Disclosure Policy.

We will not initiate legal action against researchers for security research activities conducted in good faith and in compliance with the conditions outlined in this policy.

This commitment applies to systems and services under Axxemble's authority and does not extend to systems owned or operated by unrelated third parties.

Researchers remain responsible for complying with applicable laws and avoiding activities that cause harm, compromise personal information, or disrupt services.

9. Further Information

Our approach to responsible vulnerability disclosure is informed by guidance from the Dutch National Cyber Security Centre (NCSC).

For additional information about coordinated vulnerability disclosure, consult the Dutch National Cyber Security Centre.

If you have discovered a security vulnerability or have questions about this policy, please contact:

Email: security@axxemble.nl

Telephone: +31 (0)85 303 8429

Thank you for helping us improve the security of Axxemble, BaseFortify.eu, and the systems and services we provide.