Responsible disclosure

Email us. Put enough in the message that we can reproduce the problem without guessing: which URL or system, what you did, what happened, and what you expected instead. Screenshots and a proof of concept help. Dutch or English, whichever suits you.

Send it to info@upwardtech.nl

We do not publish a PGP key yet. If you need to send something sensitive, say so in a first message and we will agree a secure channel before you send the detail.

• Acknowledge your report within three working days, from a person.
• Give you an initial assessment within ten working days: whether we could reproduce it, how serious we think it is, and roughly when we expect a fix.
• Keep you posted while we work on it, and tell you when it is closed.
• Credit you by name on this page if you want that, or keep you anonymous if you prefer. Your choice, not ours.
• Take no legal action against you and make no report to the police, provided you kept to the rules below. We will confirm that in writing if you ask.

• Give us a fair chance to fix it before you tell anyone else. Sixty days is the usual figure, and we would rather agree a date with you than leave it open.
• Do not access, change or delete more data than you need to demonstrate the problem. One record is proof. A database dump is not.
• Do not use the weakness to reach further into our systems or anyone else's.
• No denial of service, no volumetric or brute-force testing, no spam, and no social engineering of our people, our clients or our suppliers.
• No physical intrusion, and nothing that degrades a service a client is relying on.
• Delete whatever data you obtained once the report is closed.

Anything we operate ourselves. If you are unsure whether something belongs to us, ask before you test it.

• upwardtech.nl and every subdomain we publish.
• The mail infrastructure for upwardtech.nl: SPF, DKIM, DMARC, and anything that would let someone send mail appearing to come from us.
• The servers and the network we run ourselves.

These are either not ours to fix, or not findings.

• Client systems we host but do not own. Report them to us and we will route them to the client, but do not test them without that client's permission.
• Third-party services on their own domains.
• Missing security headers, cipher suite preferences and similar scanner output, with no demonstrated impact.
• Rate limiting on a marketing site that has no login.
• Self-XSS, clickjacking on pages with no state-changing action, and reports generated entirely by an automated tool.

We are a small company and we are not going to pretend otherwise by advertising a reward scheme we cannot fund consistently. You get a fast answer, a real fix, credit if you want it, and our thanks. If your report saves us from something serious we will talk about compensating you for your time, but we would rather say that honestly than publish a table of amounts we might not honour.

This policy is also published at /.well-known/security.txt, following RFC 9116, so a scanner or a researcher's tooling finds it without reading this page.

/.well-known/security.txt