Our promise to you

• If you have complied with the above terms of the Responsible Disclosure Policy and have not committed any other breaches, we will not take any legal action against you.
• We will respond to your report within a short period of time
• We will treat your report confidentially and will not share your personal data with third parties without your consent unless this is necessary to comply with a legal obligation.
• We will keep you informed of the progress of solving the problem.
• To thank you for any report of a security problem that is not yet known to us, we offer the opportunity to be listed in our "Hall Of Fame".
• We strive to solve all problems within a reasonable period of time, taking into consideration the criticality of the issue.
• We may choose to ignore low quality reports.

If you have any questions, we encourage you to contact us.

In case of doubt about the applicability of this policy, please contact us first, to ask for explicit permission.

We reserve the right to change the content of this Policy at any time, or to terminate the Policy.

Your promise to us

• Please refrain from using (high impact) automatic scanners, to minimize the chance of a negative effect on our services. Stay below 50 requests / second !!!
• When you notice the target is having problems responding to normal requests, please stop the test. You are also encouraged to inform us of this type of problem.
• Don’t disclose the vulnerability until we have been able to correct it. See below for possible publication.
• Don’t exploit the vulnerability by unnecessarily copying, deleting, adapting or viewing data. Or, for example, by downloading more data than is necessary to demonstrate the vulnerability.
• Don’t apply the following actions:
  • Placing malware (virus, worm, Trojan horse, etc.).
  • Copying, modifying or deleting data in a system.
  • Making changes to the system.
  • Repeatedly accessing the system or sharing access with others.
  • Using automated scanning tools.
  • Using the so-called "brute force" of access to systems.
  • Using denial-of-service or social engineering (phishing, vishing, spam,...).
• Don’t use attacks on physical security, social engineering, distributed denial of service, spam or third-party applications.
• Immediately erase all data obtained through vulnerability as soon as it is reported to the VRT.
• Don’t perform actions that could have an impact on the proper functioning of the system, both in terms of availability and performance, but also in terms of confidentiality and integrity of the data.

Acts under this Responsible Disclosure Policy should be limited to conducting tests to identify potential vulnerabilities, and sharing this information with the VRT.

If, after the vulnerability has been removed, you wish to publish information about the vulnerability, we ask you to notify us at least one month before publication, and to give us the opportunity to respond. Identifying us in a publication is only possible after we have given our explicit approval.

This text is a derivative work of "Responsible Disclosure" by Floor Terra, used under a Creative Commons Attribution licence 3.0.

!!! Don't flood our systems with requests! We will not accept reports that can be matched with high traffic scans !!!

The VRT (Flemish Radio and Television Broadcasting Organization) considers it important that its information and systems are secure.

Despite our concern for the security of these systems, it may occur that there still is a vulnerability.

If you have found a vulnerability in one of our systems, please let us know so that we can take measures as quickly as possible. We would like to work with you to protect our audience and our systems in a better way.

We have therefore opted for a policy of coordinated disclosure of vulnerabilities (also known as the ‘Responsible Disclosure Policy’) so that you can inform us when you discover a vulnerability.

This Responsible Disclosure Policy applies to all VRT systems. In any case of doubt, please contact us to clarify matters.

We are specifically looking for

• leaking of personal data
• horizontal / vertical privilege escalation
• SQLi
• ...

For that part of our services that are hosted on AWS, there's a limitiation on which amazon services you can test without additional approval. The most up to date info is available on https://aws.amazon.com/security/penetration-testing/ .

Out of scope domains - No testing allowed

• shop.*.be
• interactief.*
• dagelijksekostshop.be
• dekampioenenshop.be
• innovatie.vrt.be

Amazon

Part of our infrastructure is hosted on Amazon Web Services. The following actions are explicitly forbidden:

• DNS zone walking via Amazon Route 53 Hosted Zones
• Denial of Service (DoS) and Distributed Denial of Service (DDoS)
• Port flooding
• Protocol flooding
• Request flooding (login request flooding, API request flooding)

Part of our infrastructure also lies in the hands of external partners (adobe, google, microsoft, ...) and our responsible disclosure is not applicable on them. If you are unsure if a certain domain or product is in scope, you can always contact us before starting your tests to ask for information.

Application

• API key disclosure without proven business impact
• Wordpress usernames disclosure
• Pre-Auth Account takeover/OAuth squatting
• Self-XSS that cannot be used to exploit other users
• Verbose messages/files/directory listings without disclosing any sensitive information
• CORS misconfiguration on non-sensitive endpoints
• Missing cookie flags
• Missing security headers
• Cross-site Request Forgery with no or low impact
• Presence of autocomplete attribute on web forms
• Reverse tabnabbing
• Bypassing rate-limits or the non-existence of rate-limits.
• Best practices violations (password complexity, expiration, re-use, etc.)
• Clickjacking without proven impact/unrealistic user interaction
• CSV Injection
• Sessions not being invalidated (logout, enabling 2FA, etc.)
• Tokens leaked to third parties
• Anything related to email spoofing, SPF, DMARC or DKIM
• Content injection without being able to modify the HTML
• Username/email enumeration
• Email bombing
• HTTP Request smuggling without any proven impact
• Homograph attacks
• XMLRPC enabled
• Banner grabbing/Version disclosure
• Not stripping metadata of files
• Same-site scripting
• Subdomain takeover without taking over the subdomain
• Arbitrary file upload without proof of the existence of the uploaded file
• Blind SSRF without proven business impact (pingbacks are not sufficient)
• Disclosed/misconfigured Google Maps API keys
• Host header injection without proven business impact

General

• In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
• Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
• Spam, social engineering and physical intrusion
• DoS/DDoS attacks or brute force attacks
• Vulnerabilities that only work on software that no longer receive security updates
• Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
• Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
• Reports that state that software is out of date/vulnerable without a proof-of-concept
• The use of 3rd party malicious apps for stealing credentials
• The use of large GraphQL query attacks

Mobile

• Shared links leaked through the system clipboard
• Any URIs leaked because a malicious app has permission to view URIs opened
• The absence of certificate pinning
• Sensitive data in URLs/request bodies when protected by TLS
• Lack of obfuscation
• Path disclosure in the binary
• Lack of jailbreak & root detection
• Crashes due to malformed URL Schemes
• Lack of binary protection (anti-debugging) controls, mobile SSL pinning
• Snapshot/Pasteboard leakage
• Runtime hacking exploits (exploits only possible in a jailbroken environment)

This program follows Intigriti's contextual CVSS standard

Can I create a test account?

Yes and you are encouraged to do so! Please use your @intigriti.me email address for the account creation. More info can be found here: https://kb.intigriti.com/product-features/intigritime

What is this "Hall of fame"?

To thank you for reporting any security issue that is accepted by us, we offer the possibility to get added to the hall of fame hosted on our company website. .