Report a vulnerability

This TovoT B.V. policy covers reports of vulnerabilities in https://tovot.ai. Customer environments, subdomains, external platforms, shared hosting infrastructure and supplier systems are not automatically authorised for testing. Obtain written permission first if ownership or scope is unclear. We also accept reports about other services that may be managed by TovoT and will assess who is responsible.

Email [email protected] with the subject “Security report”. Include the affected URL or component, the discovery date, the potential impact and the minimum steps needed to reproduce the issue. Provide a safe way to contact you.

Do not include passwords, tokens, entire databases or unnecessary personal information. Send a brief initial description and request a secure transfer method for sensitive evidence. We currently publish no verified encryption key. Keep sensitive details out of the first message and ask for a secure transfer method. Ordinary email does not guarantee end-to-end encryption.

Limit your actions to the minimum needed to demonstrate the issue. Prefer your own test accounts and synthetic data. Stop and report as soon as another person’s data becomes visible; do not copy datasets or access additional records to increase the demonstrated impact.

Do not perform denial-of-service, brute force, credential stuffing, phishing or other social engineering. Do not install malware or backdoors, establish persistent access, modify or delete data, or move to other systems. Avoid intensive or automated scans that could affect availability. Before active security testing, penetration tests, disruptive scans or further investigation, obtain written permission from TovoT and every affected system owner, as also required by our Acceptable Use Policy. You can always report a vulnerability discovered accidentally; reporting itself does not require prior permission.

If an unintended effect occurs, stop and report it immediately. Secure only the minimum necessary evidence and coordinate its deletion when appropriate. This policy and security.txt do not provide blanket permission to access other people’s systems or accounts.

We aim to acknowledge reports personally within three working days and provide an initial assessment within ten working days. These are service targets; this channel does not promise 24/7 monitoring. Clearly identify active exploitation or immediate data loss in the subject.

We assess severity, exposure and potential harm, assign a handler and discuss the next steps. While a report is being handled, we aim to provide an update at least every ten working days. Remediation timing depends on risk; we do not promise a fixed resolution time for every vulnerability. Where necessary, we involve the responsible customer, supplier or coordinating body while sharing as little sensitive information as possible.

We use your contact details and report to assess, remediate and coordinate the issue and retain necessary evidence. Only authorised participants receive the information they need. We will not share your identity without your permission unless legally required.

Coordinate public disclosure with us so that protective measures can be taken first. Agree a reasonable timeline and review any extension. If we do not respond or coordination stalls, you may seek assistance from the Dutch NCSC. This coordination does not restrict mandatory legal reporting or disclosure rights. We only credit you publicly with your explicit permission. No fixed financial reward is offered.

If you act in good faith and within this policy, TovoT will not bring a civil claim or file a criminal complaint against you solely for responsibly investigating and reporting the vulnerability within this scope. For an unintended deviation, we assess intent, proportionality, harm reduction and your reporting of the incident.

TovoT cannot guarantee immunity from prosecution or actions by third parties. This policy does not restrict rights under the Dutch Whistleblower Protection Act or require prior internal reporting. Work-related wrongdoing needs its own confidential reporting route; [email protected] has not been designated as an independent integrity reporting channel.