AFAS Software
Top 1M siteVDPActivePartial Safe Harbor
Program Details
AFAS Software takes reports on a named list of corporate and AFAS Online domains, and treats anything not on that list as out of scope. Customers may also test the accept and test endpoints provisioned for them, and are asked to keep research off production because AFAS Online resources are shared. First response comes within 72 hours on working days, and AFAS says it will thank reporters in a fitting way rather than naming a reward.
- Response SLA
- 3 business days
Rules & Testing
Excluded Methods
DosSocial EngineeringPhishingPhysical Access
In-Scope Domains
- www.afas.nl
- www.afas.be
- www.afas.com
- help.afas.nl
- afas.help
- klant.afas.nl
- connect.afas.nl
- refinery.afaslink.nl
- www.afaslink.nl
- idp.afasonline.com
- login.afasonline.com
- portal.afasonline.com
- sts.afasonline.com
- *.insiteaccept.afas.online
- *.insitetest.afas.online
- *.soapaccept.afas.online
- *.soaptest.afas.online
- *.restaccept.afas.online
- *.resttest.afas.online
Out of Scope
Any asset not named in the scope list, Other customers' endpoints
Security
- PGP Key
- https://www.afas.nl/publickey.txt
- Preferred Languages
- Dutch, English
security.txt
- Contact
- mailto:[email protected]
- Encryption
- https://www.afas.nl/publickey.txt
- Policy
- https://www.afas.nl/portal-bedrijfspagina/responsible-disclosure
- Hiring
- https://www.werkenbijafas.nl/
- Languages
- nl, en
- Expires
- Jan 1, 2027