Skip to content

Responsible disclosure

Version 2026.1, updated 6 October 2026

WIWO Media (a trade name of CW Nederland B.V.) takes the security of its systems and its customers' data very seriously. Even so, a weakness may slip through. If you have found a vulnerability, we would like to hear about it so we can fix it as quickly as possible. This page explains how to report a vulnerability, the rules we ask you to follow and what you can expect from us. This approach is also known as coordinated vulnerability disclosure (CVD).

This English version is provided for convenience. In case of any discrepancy, the Dutch version prevails.

How to report a vulnerability

Send your report by email to security@wiwomedia.nl. Our security contact details are also published in /.well-known/security.txt, in line with the international standard RFC 9116.

Please include at least:

  • the system, URL or service concerned;
  • a description of the vulnerability and its possible impact;
  • the steps needed to reproduce the issue, so we can find and assess it quickly;
  • any supporting evidence, such as screenshots or a proof of concept;
  • your contact details, so we can reach you. You may also report anonymously or under a pseudonym, but we will then be unable to keep you informed.

You may write to us in Dutch or English.

Rules of engagement

We ask you to:

  • report the vulnerability as soon as possible after discovering it;
  • not exploit the vulnerability beyond what is needed to demonstrate it. Do not download, modify or delete data. A screenshot of a directory listing or retrieving your own data is enough;
  • not view, store or share data belonging to customers or third parties. If you come across personal data by accident, stop immediately, tell us, and delete anything you may have saved;
  • not make any changes to our systems or install a backdoor, not even to demonstrate a vulnerability;
  • not share the vulnerability with others or disclose it publicly until it has been fixed and we have agreed on a disclosure date together;
  • not use social engineering, phishing or physical attacks, and not attempt to enter our premises;
  • not carry out attacks that affect the availability of our services, such as (D)DoS attacks, and not run automated scans that overload our systems or those of our customers;
  • not run brute-force attacks against login pages or use other people's credentials;
  • only investigate our own systems. Websites and applications of our customers that run on our servers belong to those customers. If you find a vulnerability there, report it to the customer directly or, if that is not possible, to us, without investigating further.

What we promise

  • We will respond to your report within 5 business days with our initial assessment and an expected timeline for a fix.
  • We will keep you informed of our progress.
  • We will treat your report confidentially and will not share your personal data with third parties without your permission, unless we are legally required to do so.
  • If you follow these rules, we will not report you to the police or take legal action against you in connection with your report.
  • We will fix the vulnerability as quickly as reasonably possible, depending on its severity and complexity.
  • If you wish, we will credit you as the finder when we publish about the vulnerability.

Out of scope

As a rule, we do not handle the following reports, because they pose little or no security risk or are outside our control:

  • missing or differently configured HTTP security headers without a demonstrable abuse scenario;
  • missing SPF, DKIM or DMARC records on domains that are not ours, or reports about mail settings without concrete abuse;
  • clickjacking on pages without sensitive actions;
  • software version information or banners without an associated vulnerability;
  • vulnerabilities that only work in outdated browsers or on rooted or jailbroken devices;
  • output from automated scanners without verification and without an explanation of the impact;
  • rate limiting, or the lack of it, on non-sensitive forms;
  • vulnerabilities in websites, plugins or software of customers or third parties;
  • (D)DoS vulnerabilities, social engineering and physical security.

Rewards

We appreciate your help in making our systems more secure. Whether and how we reward a report is at our sole discretion, depending on the severity of the vulnerability and the quality of the report. A reward could be, for example, a public credit or a small token of thanks. There is no entitlement to a reward, and we do not run a formal bug bounty programme.

Other reports

Please note: WIWO Media only sends email from addresses ending in @wiwomedia.nl or @cwnl.eu, and never asks for passwords or payment details by email.