Responsible disclosure

1. What this policy covers

This policy covers every Harmony system that can be reached from the public internet, including the website harmonygroup.eu.

Research beyond these limits is not covered by this policy and may be a criminal offence.

Nor is this policy an invitation to actively scan our network for weak spots. We do that ourselves.

2. Making a report

Send your findings to security@harmonygroup.eu as soon as possible after you discover them. Include, as fully as you can:

• what type of vulnerability it is, and on which system (URL or IP address);
• how you found it and how we can reproduce it, with the tools you used and the time of your research;
• evidence, such as screenshots, without confidential data;
• your contact details (email address or phone number), so that we can keep you informed.

If you are researching a system in Belgium, read point 6 as well: to be protected by law, you report the vulnerability there in two steps, to us and to the CCB.

3. What we do with your report

• You receive an acknowledgement within three working days.
• Within five working days of that acknowledgement, we tell you how we assess the report and when we expect a fix. After that, we keep you informed.
• We treat your report confidentially and do not share your details with others without your consent, unless the law or a court requires us to.
• If the vulnerability also affects others, such as the supplier of the software, we inform them before anything about it is made public.
• If you do not hear from us, you can ask the CCB to mediate (vulnerabilityreport@ccb.belgium.be).

4. Rules of engagement

We ask you to act responsibly:

• Do no more than is needed to demonstrate the vulnerability. Once you have shown it on a small scale, stop.
• Do not abuse the vulnerability: download no more data than needed, and do not view, change or delete other people's data.
• Do not make changes to our systems or install malware or other software on them.
• Do not disrupt our services: no (D)DoS attacks and no brute-force techniques.
• Do not use social engineering, phishing or spam to gain access.
• Do not intercept or read communications that are not meant for you.
• Do not try to access a system more often than needed.
• If you come across personal data or other confidential data, look no further and do not keep it. If you did keep it, delete it straight away.
• Share what you found with no one else until the problem is fixed and we have agreed together on disclosure.
• Do not ask for money or anything else in return for your findings.
• Where you can, make yourself known during your research, for example with a recognisable header in your requests.
• Secure your own systems well, so that your findings do not leak.

5. Disclosure

We decide together with you whether and how to publish anything about the vulnerability, and only after it has been fixed.

If it concerns a system in Belgium, Belgian law allows a vulnerability to be made public only with the CCB's consent.

6. No criminal complaint or claim

Researching vulnerabilities can involve acts that are criminal offences. If you follow this policy in good faith, with no ill intent and no gain for yourself, Harmony will not file a criminal complaint or claim damages.

Harmony does not decide on behalf of the Public Prosecution Service in the Netherlands or the public prosecutor in Belgium, who judge for themselves whether to prosecute.

In Belgium, the law itself also protects ethical hackers (the NIS2 law of 26 April 2024, articles 22 and 23). That protection only applies if you meet the conditions of that law. You then report the vulnerability in two steps, both to us and to the CCB (vulnerabilityreport@ccb.belgium.be): a short notification within 24 hours of your discovery, and a full one within 72 hours. The CCB's reporting procedure (opens in a new tab) explains how.

That legal protection applies in Belgium only. If a system is wholly or partly in another country, that country's rules apply there.

7. Reward

If you wish, we mention your name as the discoverer when we publish anything about the vulnerability. For a serious, previously unknown vulnerability we may also give you a reward; we decide that for each report.

8. Your personal data

When you report, you may share personal data with us, such as your name and email address. We use it only to follow up your report, and delete it no later than one month after the problem has been fixed. You can read more in our privacy policy.

9. What not to report here

The address security@harmonygroup.eu is not meant for:

• reports that our website or one of our services is unavailable;
• complaints;
• fake emails (phishing);
• missing HTTP security headers, unless that demonstrably leads to a security problem;
• technical information such as version numbers or IP addresses, unless it can be misused directly;
• cross-site scripting on pages without sensitive data;
• security problems without a realistic way to exploit them.

Employees of Harmony and of affiliated companies follow the internal incident procedure.

10. What this policy is based on

The Coordinated Vulnerability Disclosure guideline of the National Cyber Security Centre (Ministry of Justice and Security, the Netherlands), and the guide to CVD policies (opens in a new tab) of the Centre for Cybersecurity Belgium together with the legal framework in the Belgian NIS2 law.