Website laten maken
Acting responsibly

Reporting vulnerabilities

Security measures

Responsible vulnerability reporting rules include, but are not limited to:

  • Avoid accessing, exploiting or exposing customer data other than your own,
  • Avoid any action that may cause degradation of our services or harm our customers (for example, overloading our systems),
  • Keep details of vulnerabilities confidential for at least 60 days after 2manydots is notified; based on our investigation, we may extend this confidentiality period,
  • Do not use social engineering techniques, such as sending phishing emails to employees, partners or customers of 2manydots,
  • When methods are used that do not comply with your local legislation, Dutch legislation and/or the responsibility rules mentioned above, the enforcement authorities will be informed.

Our security team assesses your eligibility for reward compensation.
We use the following guidelines to determine the validity of requests and the reward compensation offered.

Reproducibility

Our security team and engineers should be able to reproduce the reported security error.
Please make sure your report is clearly written and contains all the necessary information so we can reproduce the error.
Please include the following:

  • Type of vulnerability
  • If the vulnerability is in one of our web services, please specify the URL
  • The potential impact of vulnerability
  • Step-by-step instructions to reproduce the problem, including any proof-of-concept or exploit code to reproduce it

Definition of a vulnerability

To be eligible for a reward, your report must be considered valid by 2manydots’ security team.
2manydots’ platform can be accessed through the following hosts:

  • www.2manydots.nl
  • support.2manydots.nl
  • client.2manydots.nl

Examples of non-qualifying vulnerabilities:

  • Denial of Service (DOS) vulnerabilities.
  • Mixed-content scripts and insecure cookies outside our platform
  • Social engineering attacks against 2manydots Support
  • Vulnerabilities that require a potential victim to install non-standard software or otherwise take active steps to be vulnerable
  • Unconfirmed/unverified reports from vulnerability scanners
  • Reports that exploit the behavior of, or vulnerabilities in, outdated browsers

Rewards

At this time, there is no specific reward for reported bugs or vulnerabilities.

Report

You can contact us at [email protected] to report a vulnerability or ask questions about this program.