Skip to content
Log inNLRequest accessAccess Menu

Vulnerability disclosure

Found a weakness in noveu.eu or in one of our services? We want to hear about it. This policy explains how to report a vulnerability responsibly and what you can expect from us. It follows the Coordinated Vulnerability Disclosure guideline of the Dutch National Cyber Security Centre (NCSC).

What this policy covers

The following systems and domains are in scope:

  • noveu.eu (the website)
  • *.noveu.eu (subdomains operated by Noveu Solutions, including app.noveu.eu, api.noveu.eu, portal.noveu.eu and webmail.noveu.eu)
  • Official Noveu mobile apps (once available)
  • Our public API endpoints

Out of scope

  • Third-party services we rely on, such as Cloudflare, Hetzner, Stripe and Mollie. Please report those directly to the vendor.
  • Social engineering, phishing and attacks on the physical security of Noveu or its staff.
  • (Distributed) denial-of-service attacks and stress testing.
  • Spam, content injection into public search results and SEO issues.
  • Best-practice reports without a demonstrable security impact, such as a missing SPF or DMARC record on a domain that sends no mail, missing security headers without concrete impact, or TLS cipher preferences.
  • Self-XSS and issues that only occur in outdated browsers.
  • Output from automated scanners without your own validation.

How to report

Send your report to security@noveu.eu. That is the only reporting address.

In your report, please include:

  • a clear description of the vulnerability and its impact;
  • steps to reproduce it, a proof of concept or other evidence;
  • the affected system or URL;
  • any suggestions for a fix.

What you can expect from us

  • First response: you will hear from us within 5 business days of receipt of your report.
  • Fix: we work on a fix. How long that takes depends on severity and complexity.
  • Publication: we agree with you on whether, when and how the vulnerability is made public. As a guideline, 90 days after your report, by mutual agreement.

Safe harbor

If you report in good faith and follow the conditions below, we will not file a criminal complaint or take legal action against you. This follows Coordinated Vulnerability Disclosure: de Leidraad, the NCSC guideline (in Dutch, November 2017, consulted on 29 September 2026). This commitment binds only Noveu: the Dutch Public Prosecution Service decides for itself whether to prosecute, as the NCSC also points out.

The conditions:

  1. You stay within the scope and exclusions of this policy.
  2. You do not exfiltrate, modify or destroy customer data. You demonstrate impact with the minimum access needed and stop once the vulnerability is confirmed.
  3. You respect user privacy.
  4. You give us reasonable time to fix the issue before it is made public (90 days as a guideline, by mutual agreement).
  5. You do not disrupt the platform or make services unavailable for our customers.

Reward

Noveu does not offer a reward for reports, monetary or otherwise.

Contact

Last updated: 29 September 2026. The Dutch version is leading.

↑ Back to top
Found a vulnerability?

Send your report to our security address.

security@noveu.eu