Security Policy
Last updated
Ariafar Holding B.V. takes the security of its systems and those of its portfolio companies seriously. This policy tells you how to report a problem and what you can expect from us.
Reporting a vulnerability
Email security@ariafar.nl with the subject line
Security. Please include:
- what the issue is and which system or URL it affects;
- the steps needed to reproduce it;
- what an attacker could do with it;
- any proof-of-concept material — logs, requests, screenshots.
If a report concerns one of our portfolio companies rather than this site, send it to us anyway and we will route it.
What we commit to
- We will acknowledge your report within 3 business days.
- We will give you an initial assessment within 10 business days, including whether we consider it a vulnerability and a rough remediation timeline.
- We will keep you updated while we work on it, and tell you when it is fixed.
- We will not pursue legal action against you for research carried out in good faith and in line with this policy.
- We will credit you publicly if you would like that, once the issue is resolved.
What we ask of you
- Give us a reasonable opportunity to fix the issue before you disclose it — 90 days from your report, unless we agree otherwise.
- Do not access, modify or delete data belonging to anyone else. If you encounter personal data, stop and tell us.
- Do not degrade our services: no denial-of-service testing, no automated scanning that generates significant load, no spam or social engineering of our staff, users or suppliers.
- Do not use physical attacks against our offices or people.
- Stay within the systems we operate. Third-party services we merely use are out of scope — report those to their owners.
Scope
In scope: ariafar.nl and its subdomains, and the contact endpoint behind
the form on this site.
Out of scope: findings that require a compromised device or account to exploit; missing hardening headers with no demonstrated impact; results from automated scanners without a working proof of concept; social-engineering findings; and reports about software versions with no demonstrated exploitability on our systems.
Rewards
We do not currently run a paid bug-bounty programme. We recognise good reports publicly, with your permission.
How we protect this site
The Site is a static publication: pages are rendered at build time, and the only server-side endpoint is the contact form handler. It stores nothing. All traffic is served over HTTPS.
Changes
We will update this policy as our practices change. The “last updated” date above tells you when that last happened.