Report a vulnerability

• testtoegankelijkheid.nl and wcagtoolkit.com, and the domains that redirect to them;
• the portal and the sign-in on these two domains;
• WCAG Radar: the bookmarklet and the browser extension.

Not covered:

• services from others that we use, such as the Mollie payment page. Report a problem there to that party;
• reports about missing headers or settings that do not show what an attacker could do with them.

Email info@properaccess.nl. Please include:

• the address or part of the service it concerns;
• the steps we need to reproduce the problem;
• how to reach you, if that is a different address from the one you write from.

You can write in English or in Dutch.

• Do not view, copy or change more data than you need to show the problem. If you see other people's data, stop and report it.
• Do not delete or change data belonging to us or our customers.
• Do not take the site down. That means no attacks that overload the server and no automated scans that send thousands of requests.
• Do not try to guess passwords and do not install malicious software.
• Do not approach our staff or customers to gain access.
• Do not share the problem with anyone else until it is fixed, and delete any data you obtained during your research once it is.

• We confirm that we have received your report.
• Within 5 working days you get a response on the substance: how we assess the report and when we expect to fix it.
• We keep you informed until the problem is fixed.
• We treat your report as confidential. We do not share your name or details without your permission, unless the law requires us to.
• If you follow the rules above, we will not report you to the police.
• If you want us to thank you when the fix is out, we will mention your name or handle. If you prefer to stay anonymous, we will respect that. We do not pay a monetary reward.

We agree together on when the problem can be made public. The starting point is 60 days after your report. If it is fixed sooner, or if the fix takes longer, we will discuss another date.

This policy follows the Coordinated Vulnerability Disclosure guideline of the Dutch National Cyber Security Centre. If we change it, the date at the top changes too.