Coordinated Vulnerability Disclosure Policy

X-Clu BV · VAT BE 0561.947.031 · Sint-Martinusstraat 20, 3806 Velm, Belgium
General contact: info@x-clu.com

Introduction

Security research helps us keep our systems safe. This policy tells you how to report a vulnerability in X-Clu's systems and what you can expect from us.

1. Scope

In scope: www.x-clu.com (this website) and systems operated by X-Clu BV.

Out of scope: the Evidato platform (report those findings via Evidato's own disclosure policy), systems of our clients, denial-of-service testing, social engineering, physical attacks, and third-party services we do not operate.

2. How to report

Use our disclosure form: app.evidato.com/cvd/x-clu. You can report anonymously; leaving an e-mail address lets us keep you informed. Machine-readable details: /.well-known/security.txt.

Please include enough detail to reproduce the issue, and do not include more personal data than needed.

3. What we ask

Act in good faith: do not disrupt our services, do not access, modify or exfiltrate data that is not yours (if you stumble on someone else's data, stop and report), do not run automated scans that degrade our systems, and give us reasonable time to remediate before publishing details.

4. What you can expect

We register every report and confirm receipt with a reference. We investigate, remediate on severity-based timelines, and keep you informed if you left contact details. When the issue is fixed we are happy to credit you, if you wish.

5. Safe harbour

Good-faith security research conducted within this policy will not lead to legal action by X-Clu BV. This is our commitment under Belgium's coordinated vulnerability disclosure framework (CCB CVDP); it cannot bind third parties or authorities, but reports made via the CCB's procedure enjoy the protections of Belgian law.

6. Personal data

Reporter details are processed per our privacy policy and used only to handle the report and coordinate disclosure.