Report a vulnerability
WebOké (Webawere Internet Solutions B.V.) takes the security of its systems seriously. However careful we are, a weak spot can never be ruled out completely.
Have you found a vulnerability in our websites, the customer portal, our DNS servers and nameservers, email or the API? Let us know, so we can fix it before anyone abuses it.
Contact: mailto:security@weboke.nlExpires: 2027-11-12T00:00:00.000ZPreferred-Languages: nl, enCanonical: https://www.weboke.nl/.well-known/security.txtPolicy: https://www.weboke.nl/kwetsbaarheid-meldenEmail your report to security@weboke.nl
Report the vulnerability as soon as possible after you find it. The better you describe it, the faster we can fix it.
security@weboke.nlWe do not use PGP. Only send what is needed to demonstrate the vulnerability, never data of others.
Put this in your email
The problem
What you found, where it is and what someone could do with it.
The steps
How we can reproduce it: the URL, the request or the actions, step by step.
IP address and time
The IP address you tested from and when, so we can find your traffic in our logs.
Your contact details
An email address or phone number, so we can discuss it with you.
Closing a vulnerability safely, together
A responsible report helps everyone. That is why we agree on what we ask of you and what you can expect from us.
What we ask of you
- Do not exploit the vulnerability further than needed to demonstrate it.
- Do not view, copy, change or delete data of customers or others.
- Do not take any data from the system and do not make changes to the system.
- Do not install malware or backdoors.
- Do not share the vulnerability with anyone else until it is fixed.
- No social engineering, (D)DoS attacks, physical tests, spam or brute force.
- Delete any data you obtained during your research right after your report.
What we promise
- You receive an acknowledgement within 3 working days.
- We aim to fix the vulnerability within 60 days.
- We keep you informed of the progress.
- We treat your report confidentially and do not share your details without your permission.
- If you follow these ground rules, we will not report you to the police.
- Once the vulnerability is fixed, you may publish about it in consultation with us.
- If you wish, we name you as the person who found it.
We are happy to invest in security
We are happy to invest in security, and a good report helps us do that. If you report a new vulnerability with impact, you can get a place in the Hall of Fame on this page. The best reports receive a letter of thanks. Depending on the severity, we can also agree on a cash reward with you.
Eligible for an extra reward
- Cross-site scripting (XSS) with impact on other users
- Remote code execution, including SQL injection and command injection
- Server-side request forgery (SSRF)
- Access to data of other customers
- Changing DNS zones without authorisation
Out of scope, no reward
- Self-XSS
- Social engineering
- (D)DoS attacks
- Physical tests
- Man-in-the-middle attacks
- Reports from automated scanners without demonstrated impact
- Missing headers without an abuse scenario
- Websites that customers manage themselves: report those to the owner of the website
Other vulnerabilities are welcome too. The final reward may differ from these examples.
With thanks to
These people made WebOké safer by reporting a vulnerability responsibly.
No entries yet.
Found a vulnerability?
Email it to security@weboke.nl. Our contact address and this policy are also listed in our security.txt.