Alliander
Top 1M siteProgram Details
The Dutch grid operator runs a coordinated vulnerability disclosure process on its own site, with Dutch and English contact forms alongside a direct email address. Reports are answered within five business days with an assessment and an expected fix date, and Alliander undertakes not to pursue legal action against reporters who follow the procedure. Qualifying findings are web application vulnerabilities, and researchers whose reports qualify are offered a security hoodie.
- Response SLA
- 5 business days
- Report Submission
- https://www.alliander.com/en/contact-form-cvd/
Rules & Testing
Excluded Methods
Scope (1 targets)
- Alliander web applications web
Out of Scope
Reports of outdated software versions, Missing best practices, or output from automated scanning tools without evidence of exploitability, Known-vulnerable components without a relevant proof of concept, Self-XSS, and XSS affecting only outdated browsers, TLS and SSL issues, and SPF, DMARC and DKIM configuration, Missing security headers such as content-type-options and X-XSS-Protection, Username enumeration, Denial of service and distributed denial of service, Rate limiting and brute force, UI and UX bugs, and typos, Vulnerabilities in end-of-life products, Unrestricted file uploads, Session restriction and session timeout, Formula and CSV injection
Recognition
- Swag
- Alliander Security Hoodie
Security
- PGP Key
- https://www.alliander.com/.well-known/responsible.disclosure.asc
- Preferred Languages
- Dutch, English
security.txt
- Contact
- https://www.alliander.com/nl/contactformulier-cvd/, https://www.alliander.com/en/contact-form-cvd/, mailto:[email protected]
- Encryption
- https://www.alliander.com/.well-known/responsible.disclosure.asc
- Policy
- https://www.alliander.com/en/coordinated-vulnerability-disclosure/
- Hiring
- https://werkenbij.alliander.com
- Languages
- nl,en
- Expires
- Jan 31, 2028