Report securely: start with a short description through the secure reporting form. You then exchange sensitive information in a secure case file on our own platform.
Within scope
- This public website and its own API routes.
- The certificate register and the verification pages.
- Unintended access to non-public data managed by Charter Nine itself.
- Abuse that can cause an invalid badge to be presented as valid.
Secure test boundaries
Limit each check to the strictly necessary evidence and omit the following actions:
- Denial-of-service, volume tests, or actions that disrupt availability.
- Social engineering, phishing or physical attempts.
- Maintain access, modify data, download or share further than strictly necessary to demonstrate the problem.
- Testing systems of customers, suppliers, or other third parties without their explicit permission.
- Automated scans with high frequency.
What we need in a report
- The involved URL or function.
- A short, reproducible description.
- The potential impact.
- Your preferred contact and, if desired, name or pseudonym.
Our approach
We confirm receipt, validate the report, immediately limit the risk if necessary, and communicate an appropriate follow-up period. Acknowledgment always takes place in consultation and only with your consent.
This policy does not grant permission to violate Belgian or European law. In case of doubt, stop the test and contact us first.