Responsible disclosure

1. Introduction

Pravos develops Kosmos, a platform that supports security and safety professionals in the public sector in their work. Our customers, and the people whose information they record in Kosmos, rely on it being secure. If you have found a vulnerability in one of our systems, we would like to hear from you, so that we can fix it before it can be misused.

This policy explains how to report a vulnerability and what you can expect from us. It is based on the Coordinated Vulnerability Disclosure guideline of the Dutch National Cyber Security Centre (NCSC).

2. Scope

This policy applies to:

• the Pravos website;
• Kosmos, including Kompas and Pro Verbaal, in the environments that Pravos operates itself;
• Pravos Academy.

If Kosmos runs in an environment operated by a customer, you need that customer's permission to test it. You can still report vulnerabilities in the Kosmos software itself to us.

Out of scope are systems of our suppliers (please report those to the supplier concerned), social engineering and phishing, physical attacks on our offices, denial-of-service attacks, and reports without a demonstrable security impact, such as missing best-practice settings.

3. How to report a vulnerability

Email your report to security@pravos.nl, in English or Dutch. Please include:

• what the vulnerability is and how it could be exploited;
• the system, URL or product affected;
• the steps needed to reproduce it, with screenshots or proof-of-concept code if available;
• your contact details, if you would like us to keep you informed.

Do not include more personal data in your report than needed to explain the vulnerability. You may report anonymously, but we cannot then keep you informed.

4. Rules

When you investigate a possible vulnerability, please:

• report it as soon as possible, and do not share it with others until it has been fixed;
• do no more than needed to demonstrate the vulnerability: do not copy, change or delete data, do not change systems, do not install backdoors or malware, and do not try to gain further access;
• stop as soon as you gain access to personal data or customer data, tell us in your report, and delete any data you obtained;
• do not use brute force, denial-of-service attacks or aggressive automated scanning.

5. What you can expect from us

• You receive an automatic confirmation of your report, and within five working days a response with our assessment.
• We keep you informed of our progress, and treat your report and your personal details confidentially. We only use your details to handle your report, in line with our privacy notice.
• We aim to fix a confirmed vulnerability within 90 days. Together with you, we agree when information about it can be made public, once it has been fixed.
• If you act in good faith and follow this policy, we will not take legal action against you or report you to the police. We cannot make this commitment on behalf of our customers, our suppliers or the Public Prosecution Service.
• With your permission, we may thank you publicly. We do not offer a monetary reward.