Vulnerability disclosure policy

Policy

Vulnerability disclosure policy

Responsible Disclosure at PSV

The security of our systems and the protection of the personal data of fans, members, business associates, and employees are top priorities for PSV. Despite our focus on information security, a vulnerability may still exist in one of our systems.

If you discover a security issue, please report it to us as soon as possible. We are happy to collaborate with security researchers and ethical hackers to keep our digital services secure and reliable.

This Vulnerability Disclosure Policy describes:

how to report a vulnerability;
What we expect from you:
what you can expect from PSV;
how we approach responsible security research.

This policy is not an invitation to test systems without restriction or authorization. It provides a framework for the responsible and careful reporting of security vulnerabilities.

How do you report a vulnerability?

Send your report to: security@psv.nl

Can you share sensitive information? If so, please submit it—preferably encrypted—using our public PGP key.

Include as much of the following information as possible in your report:

a description of the vulnerability;
the relevant URL, application, or API;
the date and time when you identified the vulnerability;
the potential impact;
the steps to reproduce the problem;
screenshots or a limited proof-of-concept when necessary.

The more complete the information, the faster we can assess and resolve the report.

Scope

This policy applies to:

websites and web applications within the psv.nl/en domain;
subdomains of psv.nl/en;
mobile applications offered by PSV;
publicly accessible APIs that are part of PSV’s services.

Are you unsure whether a system falls within the scope? Please contact us.

Outside the scope

The following activities are not covered by this Vulnerability Disclosure Policy:

social engineering of employees, fans, or suppliers;
physical attacks on buildings, equipment, or facilities;
denial-of-service attacks (DoS or DDoS);
load and stress tests;
spam or phishing campaigns;
large-scale automated scans that may affect the availability of systems;
vulnerabilities without demonstrable impact;
systems from external vendors that PSV does not manage.

If you discover a vulnerability in a supplier’s system, please report it to us. We will ensure that the report is forwarded to the appropriate party.

What do we expect from you?

We ask that you:

to act in good faith;
not to go beyond what is necessary to demonstrate the vulnerability;
view, modify, copy, or delete third-party data;
No accounts to take over;
not to leave behind any malware, backdoors, or other forms of persistent access;
not to disrupt or render systems unavailable;
to handle the vulnerability confidentially until it is resolved;
Delete any data you receive immediately once you no longer need it.

What can you expect from PSV?

Do you adhere to this policy? If so, you can expect us to:

confirm receipt of your report within three business days;
provide an initial assessment within five business days;
respond substantively within ten business days;
keep you informed of progress at least once every two weeks;
We will treat your report confidentially;
accept submissions under a pseudonym or anonymously;
We’ll acknowledge your contribution if you’d like.

PSV currently does not have a formal bug bounty program. In the event of an exceptional contribution, we may choose to offer an appropriate token of appreciation in return.

Safe Harbor

If you conduct your investigation in accordance with this policy and act in good faith, PSV will not take any legal action in response to your investigation or report.

This also applies if you unintentionally cross a line during your research, as long as you:

this is reported immediately;
immediately ceases all further activities;
any data obtained is deleted.

This protection applies only to activities that fall within the scope of this policy.

Publication deadlines

We strive to resolve vulnerabilities as quickly as possible.

Our target deadlines are:


Ernst	Target deadline
Criticism / High	Within 30 days
Medium / Low	Within 90 days

We ask that you refrain from disclosing any vulnerabilities until PSV has had sufficient opportunity to take appropriate measures.

Disclosure may take place 90 days after the confirmation of receipt. Always coordinate this with us in advance. Do not publish any personal data or information that could be directly misused.