Responsible Disclosure Policy

Introduction

Index B.V. takes the security of its products and services seriously. We appreciate the efforts of security researchers who help us identify and resolve vulnerabilities, and we aim to make it easy and safe for you to do so. This policy outlines the rules for reporting a security vulnerability you have discovered.

Scope

This Responsible Disclosure Policy applies to software, applications, and systems developed and managed by Index. Security vulnerabilities in these systems can be reported to Index under this policy. Researchers must limit their activities to identifying and reporting vulnerabilities without compromising the availability, integrity, or confidentiality of systems and data.

Legal Position and Safe Harbour

Index B.V. will not take legal action against researchers who report vulnerabilities in good faith, remain within the scope of this policy, do not access or modify more data than necessary to substantiate their findings, and comply with the disclosure timeline, insofar as this is within Index's authority.

Conditions

• Only disclose a vulnerability publicly after coordinating with Index. As a general guideline, we apply a 90-day disclosure period from the date we receive the report.

• Do not access, modify, exfiltrate, or destroy data belonging to Index or its customers.

• Do not perform tests that disrupt services for other users (including DoS attacks or automated scanning at rates that affect performance).

• Do not test customer environments without the customer's explicit prior consent.

• Reports must be submitted in Dutch or English and contain sufficient detail to reproduce the vulnerability.

How to Report a Vulnerability

Send your report to security@index.nl. Please include:

• A clear description of the vulnerability and its potential impact.

• Step-by-step instructions to reproduce the issue, including proof-of-concept code, screenshots, or videos where applicable.

• The affected URL, endpoint, product, and version.

• Your contact details if you wish to receive updates or be publicly acknowledged.

What You Can Expect from Us

• Acknowledgement of your report within 5 business days.

• A substantive assessment and an indication of the expected remediation timeline within 20 business days.

• Status updates throughout the investigation and remediation process.

• Public recognition on our Hall of Fame, if you wish.

• We do not offer financial rewards for vulnerability reports, but we appreciate the efforts of researchers who contribute to the security of our systems.

Acceptance Criteria and Prioritisation

Index B.V. evaluates reports based on the severity, practical exploitability, and potential impact on the security of systems and data. Vulnerabilities are classified into four priority levels: low, medium, high, and critical. The Common Vulnerability Scoring System (CVSS) may be used as a supporting tool.

Reports without a demonstrable security risk, such as theoretical vulnerabilities, missing security headers without practical impact, general security recommendations, or unsubstantiated automated scan results, are generally not accepted.

Each report is assessed individually and followed up where necessary.