Coordinated Vulnerability Disclosure

At Rijk Zwaan Zaadteelt and Zaadhandel B.V., we consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.

If you discover a vulnerability, we would like to know about it so we can take steps to address it as quickly as possible. We would like to ask you to help us better protect our clients and our systems. 

We ask you:

• To email your findings to security@rijkzwaan.com. Please encrypt your findings using our PGP key to prevent this critical information from falling into the wrong hands. 
• Provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.
• Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying other people's data.
• Keep the problem secret and not share it with others until it is solved.
• Immediately erase all confidential data obtained through the breach. 
• Do not use attacks on physical security, social engineering or hacking tools like vulnerability scanners.

What we promise:

• We will respond to your report as soon as possible with our evaluation of the report and an expected resolution date.
• If you have followed the instructions above, we will not take any legal action against you concerning the report.
• We will handle your report with strict confidentiality, and not pass on your personal details to third parties without your permission, unless required to be disclosed by law or by order of the Court. Reporting under a pseudonym is possible.
• We will keep you informed of the progress towards resolving the problem.
• As a gesture of our gratitude for your assistance, we offer a reward for every report of a security problem that was not yet known to us. The reward will be determined by us based on the severity of the breach and the quality of the report.

Privacy

Rijk Zwaan will treat your report confidentially. The contact information is only used to keep you informed about above matters. Rijk Zwaan does not share personal data with third parties without your permission, unless law or a court decision requires this. 

Exclusions

Below are examples of known vulnerabilities and accepted risks that are out of scope of the policy and are therefore not taken into consideration:

• HTTP 404 codes/ pages or other HTTP codes/ pages and Content Spoofing/ text injection on these pages.
• Report of outdated software or upgrade possibility without sharing the associated proof of concept of a working exploit.
• Systems and protocols that can be abused for a DDoS attack.
• Issues with SSL configurations:
  • SSL forward secrecy disabled.
  • Weak/ insecure cipher suites. 
  • DNS CAA records.
• Anything related to HTTP security headers, for example:
  • Strict-Transport-Security.
  • X-Frame Options.
  • X-XSS-Protection.
  • X-Content-Type-Options.
  • Content-Security Policy.

Version 1.2 of 14 December 2022