Report a vulnerability (CVD)

Send your finding by email to info@marcovader.nl. Please include:

• which page, feature or URL is affected;
• what you found and what the possible consequences are;
• the steps to reproduce it, with screenshots if possible;
• how we can reach you, and whether you would like to be thanked by name.

You can report in Dutch, English or German. This address is also listed in our security.txt.

• Do not exploit the problem any further than needed to demonstrate it.
• Do not view, copy, change or delete other people's data, such as subscribers' email addresses. If you manage to, stop and report what you saw.
• Do not carry out attacks that disrupt or slow down the site (denial of service), and do not scan so intensively that the site is affected.
• Do not use social engineering, phishing or physical access, and do not install anything on our systems.
• Do not share the problem with others until it has been fixed, and delete any confidential data you obtained as soon as you have reported it.

• Within 5 working days, confirmation that we have received your report, with an initial assessment.
• We keep you informed of progress and aim to fix the problem within 90 days. We agree on the timing of publication together.
• We treat your report confidentially and do not share your details without your permission.
• If you comply with this policy, we will not report you to the police or take legal action.
• If you wish, we will mention you by name in the list of thanks below once the issue has been fixed.

IACS Radar has no bug bounty programme: there is no financial reward for a report.

This policy applies to iacsradar.nl: the website, the RSS feeds, the email notifications and the underlying APIs.

Do not report these to us, but to the party concerned:

• Vulnerabilities in OT and ICS products listed on IACS Radar. Report those to the vendor (its PSIRT), to CERT@VDE or to the NCSC. IACS Radar only publishes information that vendors and governments have already made public.
• Problems in the sources we use (NVD, CISA, EPSS, vendor feeds) or in the services the site runs on.

We are happy to receive findings without a demonstrable risk, but we do not treat them as vulnerabilities. Examples are version numbers in headers, missing security headers without a concrete consequence, or the output of an automated scan without explanation.

Here we thank everyone who has reported a vulnerability responsibly. There are no reports on this list yet.