CZ
Top 1M siteVDPActive RecognitionFull Safe Harbor
Program Details
CZ takes vulnerability reports by email under a responsible disclosure policy based on the Dutch NCSC guidelines, and publishes a PGP key on the same page for encrypting them. The first reply comes within two working days, with an assessment and expected fix date within ten. Reports can be anonymous or under a pseudonym, CZ names the finder when it reports on the issue if they want that, and it won't take legal action against reporters who act in good faith and follow the rules.
- Allows Disclosure
- Yes
- Response SLA
- 2 business days
Rules & Testing
Excluded Methods
Automated Scanning
Legal & Standards
Standards
Dutch NCSC guidelines
Security
- PGP Key
- https://www.cz.nl/over-cz/beveiligingsprobleem-melden
- Preferred Languages
- Dutch, English
security.txt
- Contact
- mailto:[email protected]
- Encryption
- https://www.cz.nl/over-cz/beveiligingsprobleem-melden
- Policy
- https://www.cz.nl/over-cz/beveiligingsprobleem-melden
- Languages
- nl, en
- Expires
- Dec 30, 2029