Coordinated vulnerability disclosure policy

Our commitment

The security of our services and products is at the heart of what we do. If you believe you have found a vulnerability, please report it to us responsibly, following the rules below, so that we can fix it before any public disclosure.

Varden Security does not run a financial reward programme (bug bounty). With your consent, we are happy to acknowledge your contribution once the vulnerability has been fixed.

Scope

This policy covers:

• ●the websites varden-security.eu and varden.io;
• ●the app.varden.io platform and the Sentinel OSINT service (osint.varden-security.eu);
• ●the Sentinel Monitoring probe software and the Sentinel engine supplied to our partners.

Out of scope: our customers' systems, our suppliers' services (hosting, payment, email), as well as denial-of-service attacks, social engineering, physical testing and unsolicited messages.

How to report a vulnerability

Write to security@varden.io and include:

• ●the affected service or product and its version, if known;
• ●a description of the vulnerability and its possible impact;
• ●the steps to reproduce it, with a proof of concept limited to what is strictly necessary;
• ●your contact details, if you would like us to get back to you.

You may write in French, English or Dutch. If you wish to send us encrypted information, ask us for a key through the same channel.

Rules to follow

For your research to remain in good faith, we ask you:

• ●to act without fraudulent intent or intent to cause harm;
• ●to limit yourself to the actions strictly necessary to demonstrate the vulnerability;
• ●not to access, copy, modify or delete data that does not belong to you, and to delete any data obtained by mistake;
• ●not to degrade the availability of our services;
• ●to report the vulnerability as soon as possible and not to disclose it before it is fixed or without our agreement.

In Belgium, good-faith vulnerability reporting is governed by law. Its conditions are set out by the Centre for Cybersecurity Belgium (CCB), to which the report may also be sent.

How we handle your report

• ●we acknowledge receipt of your report;
• ●we analyse the vulnerability and inform you of our assessment;
• ●we fix the vulnerability and keep you informed of progress;
• ●we agree with you on the timing and content of any publication.

Where a vulnerability affects a product we place on the market, we comply with the reporting obligations of the EU Cyber Resilience Act (CRA), including towards ENISA and the competent CSIRT.

Personal data

Any personal data you send us in a report is used solely to handle it, in accordance with our privacy policy.