Home / Vulnerability Disclosure Policy
Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

Purpose

If you find a security vulnerability in one of our products or systems, we want to hear about it. This policy explains how to report it, what you may and may not do while researching, and what you can expect from us. We follow the principle of coordinated vulnerability disclosure: you report to us first, we fix it, and we agree together how and when it becomes public.

Scope

The policy covers:

  • Products of RoboJob, including the software, firmware, and configuration we supply with them, for all versions within their support period
  • Our own IT systems and online services, including everything under the domains we own:
    • robojob.eu, robojob.be, robojob.de, robojob.nl
    • robojob-usa.com, robojob.us
    • robojob.cloud

Not covered: our customers' own networks and systems, and products from other manufacturers installed alongside ours. If your finding concerns a third-party component we use, report it to us anyway - we will pass it on to the manufacturer and stay involved.

How to report

Send your report to security@robojob.eu, in English, Dutch, German or French. Use the address only; general support channels will delay to your report.

You may report anonymously. If you do, we cannot ask follow-up questions or keep you informed. We do not require non-disclosure agreement or any other contract before you report.

Please include, as far as you can:

  • What the vulnerability is
  • Which product and version, which system, is affected
  • How to reproduce it, with evidence such as a proof of concept, logs or screenshots
  • What an attacker could do with it
  • How we can reach you

Rules for your research

We ask to:

  • Act in good faith, with the aim of improving security
  • Do no more than is needed to show that the vulnerability exists, then stop and report it
  • Not access, copy or change data that is not yours; if you come across personal data, stop and tell us
  • Not disrupt any system or machine - our products run in production
  • Keep the vulnerability confidential until we have agreed on disclosure

Not allowed: exploiting a vulnerability for your own of anyone else's benefit, denial-of-service attacks, social engineering of phishing of our staff or customers, installing malicious software, and physical access to machines you do not own.If you follow these rules, we will not take legal action against you in connection with your report.

What we do

  • We confirm receipt of your report within 5 working days.
  • Within 10 working days we tell you the outcome of our first assessment and what we plan to do next.
  • We keep you informed while we work on it.
  • We fix the vulnerability within a reasonable time, based on its risk. The fix may be a security update, a workaround or a configuration guideline. Where a change to an installed machine is needed, it is applied in a planned maintenance window.
  • When a fix or mitigation is available, we inform the affected customers. We agree with you if and when the vulnerability is made public. If publishing would put customers at greater risk, we may delay it and tell you why.

We treat your report confidentially and share your personal details with nobody without your consent. We do not pay for vulnerability reports and have no bug bounty program. If you want to be named as the reporter when we communicate about the vulnerability, tell us.

Legal

Belgian law protects security researchers who act in good faith. Under articles 22 and 23 of the Law of 26 April 2024 (the Belgian NIS2 law), you cannot be prosecuted for offenses such as unauthorized access if you meet the conditions of that law. Those conditions include:

  • Acting without fraudulent intent or intent to cause harm
  • Doing no more than is necessary and proportionate
  • Notifying the Centre for Cybersecurity Belgium: a simplified notification within 24 hours of discovery and a full notification within 72 hours, at vulnerabilityreport@cert.be
  • Not disclosing the vulnerability publicly without the agreement of the CCB

We may be legally required to report a vulnerability in our products to the Belgian CSIRT and ENISA under the Cyber Resilience Act. If that applies to your report, the authorities will learn of it. It does not mean anything is held against you.

About this policy

Version 1, 21 October 2026. Issued by RoboJob NV , Knotwilgenweg 19, 2220 Heist-op-den-Berg, Belgium. Questions about this policy: security@robojob.eu.