At R&R, we believe that the security of our systems is very important. If you have found a vulnerability in one of our systems, please let us know so that we can take action as soon as possible. We would like to work with you to better protect our customers and our systems.
We ask you:
- Please email your results tosecurity@rr-wfm.com.
- Do not abuse the vulnerability by, for example, downloading more data than is necessary to verify the leak, or by accessing, deleting, or modifying third-party data.
- Do not share the problem with others until it has been resolved, and delete all confidential data you received as a result of the leak immediately after the problem has been resolved.
- Please provide enough information to reproduce the issue so that we can resolve it as quickly as possible. Generally, the IP address or URL of the affected system and a description of the vulnerability are sufficient, but more information may be required for more complex vulnerabilities.
- Do not use:
- Deployment of malware.
- Copying, modifying, or deleting data in a system.
- Repeated access to the system or sharing of access with third parties.
- Brute-force methods for gaining access to systems.
- Use of denial-of-service attacks or social engineering.
What we promise:
- We will respond to your report within three days and provide you with our assessment of the report as well as an estimated date for its resolution.
- If you have met the above conditions, we will not take any legal action against you in connection with the report.
- We will treat your report as confidential and will not disclose your personal information to third parties without your consent, unless required to do so to comply with a legal obligation.
- You may register using a pseudonym.
- We will keep you updated on our progress in resolving the issue.
- When we report the issue you've reported, we will, if you wish, credit you as the person who discovered it.
We strive to resolve all issues as quickly as possible, and we are happy to help publicize the resolution once the issue has been resolved.
Source: Mandatory Disclosure
This text was written by Floor Terra and is published under a Creative Commons Attribution 3.0 license:https://creativecommons.org/licenses/by/3.0/nl/.
The original text has been adapted to the situation and to make it applicable to Q&A.
