Have you found a vulnerability in an Appfront system or service? Report it to us through a coordinated process. We handle every serious report confidentially, thank good-faith researchers and do not take legal action against responsible disclosures that remain within this policy.
Appfront develops software for clients in sectors including finance, healthcare and industry. Security is an ongoing responsibility, not a fixed state. We value the work of external researchers who help us find vulnerabilities before they can cause harm. This policy describes how you can report a vulnerability to us responsibly, what you can expect from us, and which legal frameworks apply.
We follow a coordinated vulnerability disclosure (CVD) model in line with the guidelines of the NCSC, the DIVD and ENISA. This means reporting, investigation and publication are coordinated, with the aim of fixing vulnerabilities as quickly as possible without needlessly endangering users, clients or third parties.
We do not take legal action against researchers who abide by the rules of this policy. We regard responsible reports as a service to us, our clients and the wider internet infrastructure. If you have questions about how this policy applies to a specific piece of research, you can raise them in advance with security@appfront.nl.
This policy is a living document. We update it when laws and regulations, infrastructure or insights into security research require it. Changes are published on this page, with the version date stated. For clients and auditors who wish to cite this policy in a vendor onboarding or risk assessment, the version shown on this page at the time of consultation applies.
The public production website, marketing subdomains and publicly accessible applications operated by Appfront B.V. This also includes API endpoints and authentication flows on these domains.
Cloud environments, build pipelines and deployment channels managed by us for our own services. Including publicly accessible configuration or supply-chain components that directly affect our software.
Systems belonging to our clients (even where we built them) fall under that client's policy. Third-party services such as Google Workspace, HubSpot or GitHub fall under that provider's policy.
Internal endpoints that are not publicly reachable, staging environments behind authentication, and local development environments are out of scope, unless you have inadvertently gained access and report this to us yourself.
Injection (SQL, command, LDAP), broken access control, broken authentication, server-side request forgery, insecure deserialisation and all other vulnerability classes from the current OWASP Top 10 for web and API.
Authentication bypass, session management flaws, privilege escalation, multi-tenancy leaks, IDOR vulnerabilities and weaknesses in two-factor or single sign-on implementations on systems managed by us.
Vulnerable or misconfigured dependencies, insecure build or release pipelines, leaks of credentials or secrets in public artefacts, and infrastructure misconfigurations that enable exploitation.
Responsible research protects both you and our users. Please follow the rules below, so that your research remains within policy and within the legal framework of acting in good faith under, among other things, the ISO 27001 guidelines that we follow.
No load testing, no flooding, and no tests that affect availability.
No high-frequency automated scans or broad payload sets.
A proof of concept is sufficient. Stop once you have obtained the minimum evidence needed.
No phishing or pretexting of employees, customers or suppliers.
No attempts to gain access to offices, data centres or equipment.
Do not view, copy or store personal data belonging to third parties.
Do not leave backdoors, malware or persistence in our systems.
Do not disclose the finding publicly until we have jointly agreed on a date.
Email your finding to security@appfront.nl. For sensitive content, you can request our PGP fingerprint and encrypt your message. For urgent matters, you may simultaneously copy fabian.vandijk@appfront.nl.
Provide a clear description of the vulnerability, reproducible steps, the impact you estimate, any screenshots or log entries, and a suggestion for mitigation. Please also state whether you wish to be publicly acknowledged.
You will receive an initial confirmation from our security team within five working days. We will validate the finding, determine its severity, and agree with you how we will keep you informed of progress up to publication.
An acknowledgement of receipt with an initial assessment of severity. For serious findings we generally respond more quickly. No automated no-reply.
We will keep you informed of the progress of the investigation and the fix. There are no predetermined deadlines: pace and details depend on impact, complexity and dependencies on third parties.
Publication only takes place once the fix is live in production. In line with international practice, we apply a reasonable period after confirmation, with room to deviate by mutual agreement for complex chains.
Researchers who have helped us and would like public recognition will be listed in our Hall of Fame on this page. You may also remain anonymous; we respect your choice.
Article 138ab of the Dutch Criminal Code (computer trespass) does not rule out responsible security research where it is proportionate, purpose-driven and reported. Research carried out within the rules of this policy will not lead to a report to the police by Appfront.
The Dutch Network and Information Systems Security Act (Wbni) and the European NIS2 Directive require appropriate security measures and reporting of serious incidents. A coordinated vulnerability disclosure process is a logical part of that.
For reports involving personal data, we follow Articles 33 and 34 of the GDPR on personal data breach notification. For financial sector clients, the European DORA Regulation is relevant; where applicable, we align with it and coordinate timelines and communication with supervisory authorities.
A report received at security@appfront.nl is read only by staff involved in handling it. We apply a need-to-know principle: technical details are shared only with colleagues or clients who need them to validate, reproduce and fix the vulnerability.
After initial validation, we classify the finding by severity (low, medium, high, critical) and by responsible owner. For our own systems, we schedule the fix based on that classification. For findings that affect a client or sit with a client's system, we inform the client confidentially within our contractual arrangements and coordinate with them rather than publishing unilaterally.
Communication with the reporter takes place in the same email thread, preferably in the language of the original report. For critical findings, we may ask you to be available for a brief technical verification. Once a fix has been rolled out, you will be informed, and we will discuss any coordinated publication.
Not every case is the same. The overview below helps you assess where your finding fits within this policy and what a reasonable next step is.
Report it immediately, including outside office hours. We escalate internally to incident response.
We inform the relevant client confidentially and coordinate with them.
Do not keep or share anything, and mention it in your report. We will assess the GDPR impact together.
Stop immediately, do not collect further data, and report it. No sanction for good-faith actions.
Appfront does not currently operate a bug bounty platform; we accept direct reports.
We do not normally offer cash rewards; for exceptional impact, we will discuss tailored recognition.
Refer enquiries to security@appfront.nl. We keep communication coordinated.
Clients and auditors may cite this policy as evidence during vendor onboarding.
We are glad to acknowledge by name or pseudonym the researchers who have helped us, once the first responsible disclosure has been handled and the reporter wishes to receive public recognition.
You decide whether your contribution is visible and under which name. We do not credit researchers without their explicit consent and keep disclosed information to a minimum.
For reports received through a coordinating body, such as the NCSC or DIVD, we follow their acknowledgement and communication protocols and align our publication accordingly.
Send your report to security@appfront.nl. We handle every serious report confidentially and confirm receipt within five working days. For encrypted communication, you can request our PGP fingerprint at the same address.
Appfront uses cookies and similar technologies to keep the website working properly, for analytics and for marketing. You choose what you allow. Read more in our privacy policy.
