1. Policy scope

Because of the desire to improve the performance and security of our websites, Vanbreda Risk & Benefits (Vanbreda) has decided to implement a coordinated vulnerability disclosure policy. This enables outside participants who have good intentions to identify possible vulnerabilities and/or provide Vanbreda with useful information.

Access to Vanbreda websites and IT systems within the framework of this policy is granted only to persons whose intention is to improve their security, to inform us of existing vulnerabilities, and in strict compliance with the other conditions set out in this document.

Participants are also authorised to attempt to enter IT data into the IT system concerned, subject to the purposes and conditions of this policy.

Our policy relates to security vulnerabilities that could be abused by third parties or interfere with the proper functioning of our products, services, network or IT systems. Systems dependent on third parties are outside the scope of this policy.

List of the websites within the scope of this policy:

• *.vanbreda.be
• *.vanbreda.com
• *.vanbreda.eu
• *.myvanbreda.be
• *.myvanbreda.com
• *.vanbreda.jobs
• *.vanbredanl.com
• *.vanbredanl.nl
• *.vanbredanl.nu
• *.vanbreda-riskandbenefits.be
• *.vanbreda-riskandbenefits.nl
• *.vanbreda-riskandbenefits.com
• *.vanbredariskandbenefits.be
• *.vanbredariskandbenefits.com
• *.vanbreda-international.com
• *.vanbreda-international.eu
• *.vanbredainternational.com
• *.vanbredainternational.eu
• *.vanbreda-digital.be
• *.vanbreda-agencies.be
• *.vanbreda-agencies.com
• *.vanbredaagencies.be
• *.vanbredaagencies.com
• *.vanbreda-health.be
• *.vanbredahealth.be
• *.vanbreda-healthcare.be
• *.vanbredahealthcare.be
• *.vanbredaconsultancy.com
• *.vanbredaconsultancy.nl
• *.vanbreda-marine.be
• *.vanbreda-marine.com
• *.vanbreda-proteus.be
• *.vanbreda-proteus.com
• *.vanbredaproteus.be
• *.vanbreda-lang.be
• *.vanbreda-lang.com
• *.vanbreda-lang.lu
• *.vanbredalang.be
• *.vanbredalang.com
• *.vanbredalang.lu
• *.vanbreda-ausloos.be
• *.vanbredaausloos.be
• *.vanbreda-calpa.be
• *.vanbredacalpa.be
• *.vanbreda-cornelis.be
• *.vanbreda-credinco.be
• *.vanbredacredinco.be
• *.vanbreda-dekerf.be
• *.vanbredadekerf.be
• *.vanbreda-finepolis.be
• *.vanbredafinepolis.be
• *.vanbreda-fryns.be
• *.vanbredafryns.be
• *.vanbreda-geerts.be
• *.vanbredageerts.be
• *.vanbreda-huysmans.be
• *.vanbredahuysmans.be
• *.vanbreda-infact.be
• *.vanbredainfact.be
• *.vanbreda-medius.be
• *.vanbreda-missinne.be
• *.vanbredamissinne.be
• *.vanbreda-simplex.be
• *.vanbredasimplex.be
• *.vanbreda-soenen.be
• *.vanbredasoenen.be
• *.vanbreda-waasland

List of IP subnets within the scope of this policy:

• 193.108.201.0/24
• 52.157.255.80/28
• 20.76.35.128/28
• 20.103.139.80/28

If you have any questions about the scope of this policy, please contact Vanbreda’s security team (security@vanbreda.be)

1.1 Mutual obligations of the parties

1.1.1 Proportionality

Participants undertake to comply strictly with the principle of proportionality in all their activities, i.e. not to disrupt the availability of the services provided by the system and not to exploit vulnerabilities beyond what is strictly necessary to demonstrate the security issue. Their approach must remain proportionate: if the safety problem has been demonstrated on a small scale, no further action should be taken.

1.1.2 Actions that are not allowed

Participants are not permitted to take the following actions:

• copying or altering data from the IT system or deleting data from that system;
• changing the IT system parameters;
• installing malware: viruses, worms, Trojan horses, etc.;
• Distributed Denial of Service (DDOS) attacks;
• social engineering attacks;
• phishing attacks;
• spamming;
• stealing passwords or brute force attacks;
• installing a device to intercept, store or learn of (electronic) communications that are not accessible to the public;
• the intentional interception, storage or receipt of communications not accessible to the public or of electronic communications;
• the deliberate use, maintenance, communication or distribution of the content of non-public communications or of data from an IT system where the participant should reasonably have known it had been obtained unlawfully.
   

1.1.3 Findings that are excluded

The following findings are generally considered informational and are not eligible for a reward unless the reporter demonstrates a clear and exploitable security impact:

• Missing or misconfigured security headers without demonstrable security impact.
• Version disclosure, software fingerprinting or banner grabbing.
• DNS, network or infrastructure observations without demonstrable security impact.
• Best-practice recommendations, compliance observations or security hardening suggestions.
• Missing SPF, DKIM or DMARC records where no exploitable risk can be demonstrated.
• Generic or AI-generated attack hypotheses without validation and proof of impact.
• Self-XSS or attacks that can only be performed by the reporting user against their own browser or session.
• Clickjacking affecting non-sensitive functionality.
• Rate-limiting observations without demonstrated abuse, bypass or impact.
• Exposure of identifiers, API keys, application identifiers, telemetry tokens, public certificates, client-side configuration values or similar artefacts that are intentionally public, required for the operation of the service, or cannot reasonably be protected by design.
• Reports that merely identify publicly accessible information, technologies or configurations without demonstrating a security weakness.
• Reports based solely on automated scanner results without human validation and reproducible evidence.

1.2 Confidentiality

Under no circumstances may participants share any information collected under this policy without our prior and express consent with third parties or disseminate this information to third parties.

Nor is it permitted to communicate IT data, communication data or personal data to third parties or to distribute this data to third parties.

Our policy is not intended to allow the deliberate disclosure of the content of IT data, communication data or personal data, and such disclosure may only occur by accident in the context of the detection of vulnerabilities.

If participants enlist assistance from a third party to perform their test, they shall ensure that the third party is aware of this policy in advance and agrees to comply with the terms of the policy, including confidentiality, when providing assistance.

1.3 Bona fide execution

Vanbreda undertakes to implement this policy in good faith and not to bring civil or criminal proceedings against any participant who strictly complies with its terms and conditions and who has not intentionally caused harm to the IT systems concerned.

There can be no fraudulent intent, intent to harm, or desire to use or cause harm to the visited system or its data on the part of the participant.

In case participants are in doubt about certain conditions of our policy, they must consult our point of contact in advance and must act in accordance with the written answer they receive.

1.4 Processing of personal data

A coordinated disclosure policy is not intended to primarily and intentionally process personal data. Unless it is necessary to prove the existence of a vulnerability, participants are not allowed to consult, retrieve or store personal data.

However, participants may, even by accident, get access to personal data that is stored, processed or transmitted in the IT system concerned. It may also be necessary for the participant to temporarily consult, retrieve or use personal data in the context of vulnerability detection. In this case, participants must also notify Vanbreda’s Data Protection Officer: dpo@vanbreda.be.

When processing such data, participants undertake to comply with the legal obligations concerning the protection of personal data [1] and to comply with the terms of this policy.

The processing of personal data for purposes other than the detection of vulnerabilities in Vanbreda’s systems, equipment or products is not allowed.

Participants may not store any personal data processed for longer than is necessary. During this period, participants must ensure that this information is stored with a level of protection that is proportionate to the risks (preferably encrypted). After being used for the purpose of the policy, this data must be deleted immediately.

Finally, participants must inform us of any loss of personal data as soon as possible after becoming aware of it.

[1] Regulation No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

2. Reporting security vulnerabilities

2.1 Point of contact

You must send the information discovered only to the following e-mail address: security@vanbreda.be

and/or fill in the following form:

The completed form must be sent in Word or PDF format (no scans).

You can also contact Vanbreda on the following telephone number:

+32 (0)3 217 67 67 (Vanbreda Antwerp headquarters) and ask for the Information Security Officer.

2.2 Information to be provided

Please send us the related information as soon as possible after your discovery. Provide us with sufficient information so that we can reproduce the problem and solve it as quickly as possible.

A valid report must include:

• Affected URL, host, application or system.
• Step-by-step reproduction instructions.
• The exact request(s) used.
• Proof of impact.
• Screenshots or evidence where applicable.
• An explanation of how the vulnerability was verified.

Please provide us this information in Dutch or English.
Please use Annex 1 to report vulnerabilities as a template.

2.3 Exclusions for Ai-Generated and Automated reports.

Reports generated wholly or substantially through artificial intelligence systems, large language models, automated security scanners or similar tools must be independently verified and validated by the reporter before submission.

The reporter remains solely responsible for the accuracy, completeness and reproducibility of the findings submitted.

Reports that consist primarily of copied or unverified output from artificial intelligence systems, automated security tools or vulnerability scanners, without sufficient human analysis, validation, proof of impact or reproducible evidence, may be rejected or closed without further review and are not eligible for any reward under this policy.

Reports that do not meet the minimum reporting requirements may be closed without technical investigation. The report may be reconsidered if the missing evidence is provided.

3 Procedure

3.1 Notification

Participants undertake to notify the point of contact or the coordinator referred to in point 2 of this policy as soon as possible about information on any vulnerabilities.  Participants must use the secure means of communication mentioned.

After receiving a notification, Vanbreda undertakes to send the participant a confirmation of receipt, within a reasonable period of time, containing a reminder of the obligation of confidentiality and the next steps in the procedure.

If participants do not receive a confirmation of receipt within a reasonable period of time, they may contact Vanbreda's Data Protection Officer (dpo@vanbreda.be) so this representative can contact Vanbreda's security team.

3.2 Communication

The parties undertake to do their utmost to ensure permanent and effective communication. After all, the information provided by participants may be very useful in identifying a vulnerability and resolving it.

3.3 Analysis

During the analysis phase, Vanbreda will reproduce the environment and the vulnerability identified, to check the information provided.

Vanbreda undertakes to keep participants regularly informed of the results of its analysis and of the action taken based on their notification.

In the course of this program, parties are required to link to similar or related notifications, assess the risk and severity of the vulnerability and to identify any other affected products or systems.

3.4 Developing a solution

The goal of the disclosure policy is to enable the development of a solution to eliminate the vulnerability from the IT system before harm is done.

Where possible and taking into account costs and existing knowledge, Vanbreda will try to develop a solution with its subcontractors as soon as possible, depending on the severity of the risks for the users of the systems concerned.

At this stage, Vanbreda and its subcontractors undertake to carry out, on the one hand, positive tests to check that the solution is working properly and, on the other hand, negative tests to ensure that the solution does not interfere with the proper functioning of the other existing features.

3.5 Rewarding a disclosure

Vanbreda undertakes to reward participants who report vulnerabilities in a manner that adheres to this framework. Rewards are proportional to the severity of the vulnerability reported.

Vulnerabilities are classified according to their impact on the confidentiality, integrity and availability of Vanbreda’s services, IT systems and data.
The table below provides more insight on our severity model and associated rewards.

Depending on severity, Vanbreda’s internal security team will assess the vulnerability for estimated impact. We will use the number of possibly impacted users as guidelines for rating the impact of the vulnerability.

Disclosures are only rewarded if the issue was not known by Vanbreda.

3.6 Possible publication

Vanbreda will decide, in consultation with the participant, how the existence of the vulnerability may be published. At the same time as this disclosure, a security notice will be published on Vanbreda’s website (or via e-mail), in a system update notice for users.

Vanbreda also undertakes to collect users' comments on the application of the solution and to take the necessary corrective action to resolve any problems caused by the solution, including those relating to compatibility with other products or services.

3.7 Applicable law

Belgian law shall apply to any disputes relating to the application of this policy.

3.8 Duration

The rules of the policy apply from 01/11/2026 until such time they are amended or annulled by Vanbreda. Any such amendments or annulments will be published on Vanbreda website and will automatically enter into force 30 days after their publication. 

Annex 1: Form to report vulnerabilities

Download form