Pentrox B.V.
Responsible Disclosure
This page is written for external security researchers, academic security students, and any professional who identifies a vulnerability in a Pentrox asset during the course of their own work. Pentrox thanks researchers who report issues through this process. In exchange, Pentrox commits to acknowledge every report, to triage in a defined window, to communicate remediation progress until the issue is resolved, and to offer public credit where the researcher requests it.
Pentrox does not operate a paid bug bounty programme. There is no financial reward. The commitment offered on this page is a clear process, a defined response window, a safe-harbour position under Dutch law, and optional public credit.
In scope
The following assets are in scope for responsible disclosure reports. Any host or record operated by Pentrox B.V. that is publicly reachable from the internet falls within the boundary described below.
- www.pentrox.nl, the Pentrox marketing website.
- portal.pentrox.nl, the Pentrox Portal used by clients to view findings, reports, and retest results.
- Any publicly exposed subdomain of pentrox.nl that is operated by Pentrox B.V.
- DNS records for pentrox.nl, including SPF, DKIM, and DMARC configuration.
- Email-handling configuration for the pentrox.nl domain.
- The /.well-known/security.txt file served from www.pentrox.nl and, when live, from portal.pentrox.nl.
Where a Pentrox asset is hosted on third-party infrastructure, only issues attributable to the Pentrox configuration of that infrastructure are in scope. Issues attributable to the underlying provider belong to that provider and should be reported directly to them.
Out of scope
The items below are out of scope. Reports limited to the items below are closed with reference to this page.
- Third-party software-as-a-service tools that Pentrox consumes. Issues affecting a vendor product should be reported directly to that vendor under their own disclosure process.
- Physical offices, staff mobile devices, personal accounts of Pentrox employees, and any asset not listed in the in-scope section above.
- Social engineering of Pentrox employees, vendors, or clients, including phishing, vishing, smishing, pretexting, and any attempt to extract credentials or information from a human target.
- Denial-of-service testing, volumetric attacks, and load testing of any Pentrox asset.
- Brute-force attacks, credential stuffing, password spraying, and any test that intentionally triggers account lockout.
- Vulnerabilities that require physical access to a Pentrox device or to a device in a Pentrox office.
- Issues that affect only end-of-life browsers, operating systems, or platforms that the vendor no longer supports.
- Rate-limit bypass reports without a demonstrable business impact.
- TLS or SSL configuration observations that have already been documented and accepted by Pentrox as non-risk, such as support for an older cipher retained for compatibility reasons.
- Missing best-practice HTTP response headers without a demonstrated exploit chain. A report of a missing header on its own is closed. A report that chains a missing header into a practical attack is in scope.
- Automated scanner output submitted without manual verification. Reports that are copy-pasted from a scanner without evidence of exploitability are closed.
- Theoretical findings that cannot be reproduced against a live Pentrox asset.
Rules of engagement
Testing a Pentrox asset is permitted under the conditions listed below. Compliance with every rule is a precondition for safe harbour.
- Test only assets listed in the in-scope section above. Do not test assets of Pentrox clients, partners, or upstream providers.
- Do not exfiltrate data beyond the minimum required to demonstrate the issue. A single record, a single screenshot, or a single proof-of-concept request is sufficient. Stop at the first clear demonstration.
- Do not pivot from an initial foothold into deeper systems, lateral services, or internal networks. Report the initial finding and stop.
- Do not modify, destroy, encrypt, or exfiltrate data that was not created by the reporter as part of the test.
- Do not disclose the issue publicly until Pentrox has confirmed a fix, or until 90 days have elapsed from the acknowledgement date, whichever comes first. Coordinated disclosure is preferred.
- Do not use the finding for any purpose other than the disclosure itself. Commercial use, resale, or retention of evidence beyond the disclosure process is prohibited.
- Do not attempt to compromise the privacy of Pentrox users, employees, or clients.
- Stop immediately if a finding unexpectedly exposes personal data belonging to third parties. Report what has been observed to Pentrox and delete any local copy of the exposed data before reporting.
- Do not run automated scanners at a rate or volume likely to degrade service for other users. Throttle scan traffic. Announce a planned scan window in the report if a scan is unavoidable.
- Do not impersonate Pentrox, its employees, or its clients at any point during testing or disclosure.
How to report
| Primary channel | Email to security@pentrox.nl. Plain text is accepted. Sensitive proof-of-concept material can be sent through a file-sharing link with an expiring password shared out of band. |
|---|---|
| Secondary channel for existing clients | Existing Pentrox clients who identify a vulnerability in their own Pentrox Portal account should use the findings area of the Portal. This is the preferred channel for a client finding a bug in their own Portal tenancy, because the report is tied to the authenticated account and the project. |
| Languages accepted | Reports can be written in English or Dutch. Both are processed at the same pace. A report is not downgraded for language choice. |
Include in the report
A clear report is triaged faster. The following items help Pentrox reproduce and assess the issue without a back-and-forth exchange.
- A short summary of the issue in one or two sentences.
- The affected asset, URL, endpoint, parameter, record, or configuration name.
- Step-by-step reproduction instructions, written so that a Pentrox employee can replay them without prior context.
- Supporting evidence: request and response captures, screenshots, or a minimal proof-of-concept. Redact any personal data observed during testing.
- An assessment of impact: what an attacker could do if the issue were exploited in production.
- Suggested mitigation, where the researcher has one.
- A preferred contact for follow-up: email address, handle, or pseudonym.
- A preferred name for public credit, or the word anonymous if credit is not wanted.
What Pentrox commits to
The timeframes below are the service levels Pentrox commits to for every valid report. The numbers are conservative and reflect the current capacity of the company. Where a specific report justifies a faster response, Pentrox responds faster. Where a report is highly complex, Pentrox informs the reporter of the expected timeline.
| Acknowledge receipt | Within 3 business days of the report being received at security@pentrox.nl. The acknowledgement confirms that the report has been opened for triage and assigns a reference identifier. |
|---|---|
| Initial triage | Within 10 business days of acknowledgement. Triage confirms whether the issue is reproducible, determines whether it falls within scope, and assigns an initial severity. The outcome of triage is shared with the reporter. |
| Remediation communication | The remediation timeline is communicated to the reporter after triage. Severity determines priority. Critical issues are addressed immediately. Lower-severity issues are scheduled into the next available maintenance window. |
| Progress updates | The reporter is kept informed at least every 14 calendar days until the finding is resolved, or until the report is closed with a documented reason. |
| Fix confirmation | Once a fix has been deployed, the reporter is notified. Public credit, where requested, is added only after the fix has been deployed and confirmed. |
Pentrox does not take legal action against researchers who act in good faith within the rules on this page. The safe-harbour statement below describes this commitment in detail.
Safe harbour
Pentrox B.V. commits not to pursue legal action, not to file claims, and not to support third-party claims against a security researcher who reports a vulnerability to Pentrox under this process, provided that the researcher acts in good faith, complies with the rules published on this page, gives Pentrox a reasonable window to remediate the issue before any public disclosure, and does not exploit the finding for any purpose other than the disclosure itself. This commitment is made under the laws of the Netherlands and applies to Pentrox B.V. as the operator of the in-scope assets listed above.
The safe-harbour commitment does not extend to the following conduct:
- Unauthorised access to personal data of clients, employees, or third parties beyond the minimum required to demonstrate the issue.
- Destructive testing, including deletion, modification, or encryption of data that the researcher did not create.
- Denial-of-service activity, volumetric traffic, or any test that degrades service availability.
- Extortion, public ransom demands, or any attempt to condition disclosure on payment.
- Testing of assets that are not listed in the in-scope section of this page.
- Activity that would breach Dutch law, European Union law, or applicable sanctions regimes regardless of the research intent.
Where the conduct of a researcher moves outside these limits, the safe-harbour commitment does not apply, and Pentrox retains all rights available under Dutch law. Researchers who are uncertain whether a planned test falls within scope are encouraged to ask Pentrox at security@pentrox.nl before testing.
Credit and recognition
Pentrox does not operate a paid bug bounty programme. No financial reward is offered today. The form of recognition available to researchers is public credit on this page, added after a finding has been confirmed and fixed.
- Public credit is optional. Researchers who prefer not to be named are respected and are not listed.
- Researchers who request credit can provide a preferred display name and, optionally, a link to a personal website, a professional profile, or a social profile.
- Credit is added only after the related finding has been deployed as a fix and confirmed. Credit is not added during triage or while a fix is in preparation.
- Pentrox does not share reporter contact details with third parties without the reporter consent.
- A change to the preferred display name or to the linked profile can be requested by emailing security@pentrox.nl from the same address used for the original report.
Jurisdiction and language
This responsible disclosure process is governed by the laws of the Netherlands. Any dispute arising from a report submitted under this process is subject to the exclusive jurisdiction of the competent Dutch courts.
Reports can be submitted in English or Dutch. English is the primary working language for the Pentrox Portal and the final report. Dutch is fully supported for the reporting conversation and for the public acknowledgement listing.
The English version of this page and the Dutch version of this page are both official. Where the two versions differ in substance, the English version prevails.
Related resources
This page is maintained by Pentrox B.V. and is updated when the underlying process or scope changes. Researchers who have an open report are notified of substantive changes to this page directly.