--- title: "Vulnerability disclosure policy\n | PQR" description: Meld kwetsbaarheden in PQR-diensten en ontvang ondersteuning bij het veilig oplossen. Volg ons verantwoordingsproces voor een effectieve samenwerking. --- **Scripts zijn geblokkeerd.**Deze website heeft scripts nodig om goed te kunnen werken. Door uw huidige browserinstellingen of adblocker kunnen deze niet worden geladen. Pas uw instellingen aan en vernieuw de pagina. × [Skip to content](https://pqr.com/vulnerability-disclosure#main-content) - [Kennis & Actueel](https://pqr.com/blog?hsLang=nl) - [Support](https://pqr.com/support?hsLang=nl) - [Werken bij](https://werkenbij.pqr.com?hsLang=nl) [![PQR](https://pqr.com/hs-fs/hubfs/PQR-RGB-TRANSP-WHITE.png?width=110&height=38&name=PQR-RGB-TRANSP-WHITE.png)](https://pqr.com/?hsLang=nl) - [Solutions](https://pqr.com/solutions?hsLang=nl) - [Workplace](https://pqr.com/solutions/workplace?hsLang=nl) - [Datacenter & Private Cloud](https://pqr.com/solutions/datacenter-private-cloud?hsLang=nl) - [Public Cloud](https://pqr.com/solutions/public-cloud?hsLang=nl) - [Security](https://pqr.com/solutions/security?hsLang=nl) - [Networking](https://pqr.com/solutions/networking?hsLang=nl) - [Data & AI](https://pqr.com/solutions/data-ai?hsLang=nl) - [IT Asset Management](https://pqr.com/solutions/it-asset-management?hsLang=nl) - [Sectoren](https://pqr.com/sectoren?hsLang=nl) - [Ziekenhuizen](https://pqr.com/sectoren/ziekenhuizen?hsLang=nl) - [Zorginstellingen](https://pqr.com/sectoren/zorginstellingen?hsLang=nl) - [Rijksoverheid](https://pqr.com/sectoren/rijksoverheid?hsLang=nl) - [Lokale Overheid](https://pqr.com/sectoren/lokale-overheid?hsLang=nl) - [Industry & Manufacturing](https://pqr.com/sectoren/industry-manufacturing?hsLang=nl) - [Onderwijs](https://pqr.com/sectoren/onderwijs?hsLang=nl) - [Finance](https://pqr.com/sectoren/financi%C3%ABle-markt?hsLang=nl) - [Retail & Handel](https://pqr.com/sectoren/retail-en-handel?hsLang=nl) - [Over PQR](https://pqr.com/over-ons?hsLang=nl) - [Over ons](https://pqr.com/over-ons?hsLang=nl) - [Klantcases](https://pqr.com/cases?hsLang=nl) - [Partners](https://pqr.com/partners?hsLang=nl) - [Events](https://pqr.com/events?hsLang=nl) - [Duurzaamheid](https://pqr.com/duurzaamheid?hsLang=nl) - [Recente overnames](https://pqr.com/overnames?hsLang=nl) [Contact](https://pqr.com/contact?hsLang=nl) - [Kennis & Actueel](https://pqr.com/blog?hsLang=nl) - [Support](https://pqr.com/support?hsLang=nl) - [Werken bij](https://werkenbij.pqr.com?hsLang=nl) - [Solutions](https://pqr.com/solutions?hsLang=nl) - [Workplace](https://pqr.com/solutions/workplace?hsLang=nl) - [Datacenter & Private Cloud](https://pqr.com/solutions/datacenter-private-cloud?hsLang=nl) - [Public Cloud](https://pqr.com/solutions/public-cloud?hsLang=nl) - [Security](https://pqr.com/solutions/security?hsLang=nl) - [Networking](https://pqr.com/solutions/networking?hsLang=nl) - [Data & AI](https://pqr.com/solutions/data-ai?hsLang=nl) - [IT Asset Management](https://pqr.com/solutions/it-asset-management?hsLang=nl) - [Sectoren](https://pqr.com/sectoren?hsLang=nl) - [Ziekenhuizen](https://pqr.com/sectoren/ziekenhuizen?hsLang=nl) - [Zorginstellingen](https://pqr.com/sectoren/zorginstellingen?hsLang=nl) - [Rijksoverheid](https://pqr.com/sectoren/rijksoverheid?hsLang=nl) - [Lokale Overheid](https://pqr.com/sectoren/lokale-overheid?hsLang=nl) - [Industry & Manufacturing](https://pqr.com/sectoren/industry-manufacturing?hsLang=nl) - [Onderwijs](https://pqr.com/sectoren/onderwijs?hsLang=nl) - [Finance](https://pqr.com/sectoren/financi%C3%ABle-markt?hsLang=nl) - [Retail & Handel](https://pqr.com/sectoren/retail-en-handel?hsLang=nl) - [Over PQR](https://pqr.com/over-ons?hsLang=nl) - [Over ons](https://pqr.com/over-ons?hsLang=nl) - [Klantcases](https://pqr.com/cases?hsLang=nl) - [Partners](https://pqr.com/partners?hsLang=nl) - [Events](https://pqr.com/events?hsLang=nl) - [Duurzaamheid](https://pqr.com/duurzaamheid?hsLang=nl) - [Recente overnames](https://pqr.com/overnames?hsLang=nl) [Contact](https://pqr.com/contact?hsLang=nl) ## Vulnerability Disclosure Policy PQR is fully committed to security and privacy and dives deep into all reported vulnerabilities. While we work hard every day to protect our services, vulnerabilities may still surface. On this page you will find our approach to dealing with potential vulnerabilities in all aspects of our services. ### Reporting a vulnerability Have you spotted an issue around security or privacy in PQR services? Let us know! We are open to reports from anyone, including customers, security experts and developers. This kind of report is known as a Coordinated Vulnerability Disclosure (CVD). To report a vulnerability please send an email to disclosure@pqr.com that includes: - **Service** The specific services which you believe are affected - **Behavior** A description of the behavior you observed as well as the behavior that you expected - **Description** Try to be as explicitly and detailed as possible about the problem you found. Provide enough information to reproduce the issue so that we can resolve it as soon as possible. Complex vulnerabilities may require additional explanation. For this you can use step-by-step instructions, screenshots or video demonstrations. Feel free to provide supporting material (Proof of Concept code, tool output, etc.) that can help us understand the nature and severity of the vulnerability. - **Contact details** Your email address or telephone number to enable us to contact you if we have any questions. We prefer to communicate via email. Offering a solution is highly encouraged but not required. Be assured that your notifications will be received by specialists. We only accept reports that are sent in English or Dutch. ### In Scope Did you discover a security flaw in a PQR ICT system or service? Please let us know before informing the outside world so that we can take action first. This is called 'responsible reporting' or 'responsible disclosure'. Examples of qualifying vulnerabilities are: ### Out of scope **HTTP related issues** • HTTP 404 codes/pages or other HTTP non-200 codes/pages and Content Spoofing/Text Injection on these pages • Fingerprint version banner disclosure on common/public services • OPTIONS HTTP method enabled • Anything related to HTTP security headers, e.g.: Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy. **SSL/TLS and email security issues** • SSL Configuration Issues, e.g.: SSL forward secrecy not enabled, weak / insecure cipher suites • SPF, DKIM, DMARC issues • Missing DNSSEC **Information leakage and disclosure of files** • Disclosure of known public files or directories or non-sensitive information, (e.g. robots.txt) • Information leakage in metadata **Click and UI related issues** • Clickjacking and issues only exploitable through clickjacking • Lack of Secure/HTTPOnly flags on non-sensitive Cookies **Injection attacks** • Host header injection **Older software versions and brute force attempts** • Reporting older versions of any software without proof of concept or working exploit • Username/email enumeration through brute force attempts, e.g.: via Login Page error message, Forgot Password error message. This list of exclusions is derived from a list used by the [CERT of SURF.](https://www.surf.nl/en/coordinated-vulnerability-disclosure) ### **We ask you to** ### We ask you not to ### **What we promise**   ## Klaar voor rust in jouw IT? [Neem contact op](https://pqr.com/contact?hsLang=nl)[Bekijk alle solutions](https://pqr.com/solutions?hsLang=nl) [![PQR](https://pqr.com/hs-fs/hubfs/PQR-RGB-TRANSP-WHITE.png?width=110&height=38&name=PQR-RGB-TRANSP-WHITE.png)](https://pqr.com/?hsLang=nl) Rustmakers in IT. Wij brengen rust, overzicht en controle in een wereld van complexe IT. ![Bechtle group logo](https://pqr.com/hubfs/raw_assets/web-pqr-hs/42/js_client_assets/assets/bechtle-BJCakBS8.svg) ## Solutions - [Workplace](https://pqr.com/solutions/workplace?hsLang=nl) - [Datacenter & Private Cloud](https://pqr.com/solutions/datacenter-private-cloud?hsLang=nl) - [Public Cloud](https://pqr.com/solutions/public-cloud?hsLang=nl) - [Security](https://pqr.com/solutions/security?hsLang=nl) - [Networking](https://pqr.com/solutions/networking?hsLang=nl) - [Data & AI](https://pqr.com/solutions/data-ai?hsLang=nl) - [IT Asset Management](https://pqr.com/solutions/it-asset-management?hsLang=nl) ## Sectoren ## Over PQR ## Meer - ## Solutions - [Workplace](https://pqr.com/solutions/workplace?hsLang=nl) - [Datacenter & Private Cloud](https://pqr.com/solutions/datacenter-private-cloud?hsLang=nl) - [Public Cloud](https://pqr.com/solutions/public-cloud?hsLang=nl) - [Security](https://pqr.com/solutions/security?hsLang=nl) - [Networking](https://pqr.com/solutions/networking?hsLang=nl) - [Data & AI](https://pqr.com/solutions/data-ai?hsLang=nl) - [IT Asset Management](https://pqr.com/solutions/it-asset-management?hsLang=nl) - ## Sectoren - [Ziekenhuizen](https://pqr.com/sectoren/ziekenhuizen?hsLang=nl) - [Zorginstellingen](https://pqr.com/sectoren/zorginstellingen?hsLang=nl) - [Rijksoverheid](https://pqr.com/sectoren/rijksoverheid?hsLang=nl) - [Lokale overheid](https://pqr.com/sectoren/lokale-overheid?hsLang=nl) - [Industry & manufacturing](https://pqr.com/sectoren/industry-manufacturing?hsLang=nl) - [Onderwijs](https://pqr.com/sectoren/onderwijs?hsLang=nl) - [Finance](https://pqr.com/sectoren/financi%C3%ABle-markt?hsLang=nl) - [Retail & handel](https://pqr.com/sectoren/retail-en-handel?hsLang=nl) - ## Over PQR - [Over ons](https://pqr.com/over-ons?hsLang=nl) - [Klantcases](https://pqr.com/cases?hsLang=nl) - [Werken bij](https://werkenbij.pqr.com?hsLang=nl) - [Partners](https://pqr.com/partners?hsLang=nl) - [Duurzaamheid](https://pqr.com/duurzaamheid?hsLang=nl) - ## Meer - [Kennis & Actueel](https://pqr.com/blog?hsLang=nl) - Events - Downloads - [Support](https://pqr.com/support?hsLang=nl) - [Contact](https://pqr.com/contact?hsLang=nl) ![Bechtle group logo](https://pqr.com/hubfs/raw_assets/web-pqr-hs/42/js_client_assets/assets/bechtle-BJCakBS8.svg) © 2019 - 2026 PQR B.V. Alle rechten voorbehouden. Onderdeel van Bechtle Group. - [Privacybeleid](https://pqr.com/privacybeleid?hsLang=nl) - [Cookie-verklaring](https://pqr.com/cookie-verklaring?hsLang=nl) - [Vulnerability disclosure policy](https://pqr.com/vulnerability-disclosure) - [Algemene voorwaarden](https://pqr.com/algemene-voorwaarden?hsLang=nl) Cookie settings ```json { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://pqr.com/vulnerability-disclosure", "name": " Vulnerability disclosure policy ", "datePublished": "2026-09-11T09:05:10+0000", "dateModified": "2026-09-15T07:26:11+0000", "description": "Meld kwetsbaarheden in PQR-diensten en ontvang ondersteuning bij het veilig oplossen. Volg ons verantwoordingsproces voor een effectieve samenwerking.", "url": "https://pqr.com/vulnerability-disclosure", "inLanguage": "nl", "isPartOf": { "@type": "WebSite", "@id": "https://pqr.com/#website" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://pqr.com/#website", "@type" : "WebSite", "description" : "website description", "inLanguage" : "nl", "name" : "PQR", "publisher" : { "@id" : "https://pqr.com/#organization", "@type" : "Organization" }, "url" : "https://pqr.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://pqr.com/#organization", "@type" : "Organization", "logo" : "https://cdn2.hubspot.net/hubfs/5591082/PQR%20Logo%20-%20Final%20(Outline)_WHITE_CLEAN.png", "name" : "PQR", "url" : "https://pqr.com/" } ``` ```json { "@context": "https://schema.org", "@id": "https://pqr.com/vulnerability-disclosure#breadcrumb", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://pqr.com" }, { "@type": "ListItem", "position": 2, "name": " Vulnerability disclosure policy ", "item": "https://pqr.com/vulnerability-disclosure" } ] } ```