Autovig

Responsible Disclosure

How to report a security vulnerability to Autovig: scope, reporting channel, coordinated timeline, Belgian CVD safe harbour and CCB referral.

Last reviewed
11 October 2026

In brief

  • Report a vulnerability in one structured email to security@autovig.eu with "security report" in the subject; the in-scope surface is autovig.eu, its build output and the cookie-consent flow, and reports are welcome in six languages.
  • Autovig acknowledges within 5 business days, triages within 10, and targets 90 days to remediation under a coordinated-disclosure model; there is no paid bug-bounty, only public credit.
  • Good-faith research within scope is covered by a controller-granted authorisation; the statutory exemption in article 23 of the Belgian NIS2 law also applies if you notify the CCB within 24 hours (simplified) and 72 hours (complete), and the CCB (CERT.be) is the escalation route.

Autovig welcomes security research conducted in good faith on its public properties. This policy is the controller’s coordinated-vulnerability-disclosure (CVD) policy under ISO/IEC 29147:2018, the Belgian legal framework for coordinated vulnerability disclosure (articles 22 and 23 of the Loi du 26 avril 2024, the Belgian NIS2 law, and the role of the Centre for Cybersecurity Belgium — CCB) and the ENISA Good Practice Guide on Vulnerability Disclosure. It applies to the website autovig.eu (the "Site").

1. Reporting channel

Send a single, structured report to:

If you cannot reach us, or if you do not receive an acknowledgement within the timeline at section 6, you may refer the report to the Belgian national CSIRT:

You can submit reports in English, French, German, Dutch, Romanian or Polish.

2. Scope

In scope:

  • autovig.eu and any subdomain serving production content;
  • the static-site build output: HTML, CSS, JS bundles, and the structured data we emit;
  • the cookie consent flow and the consent storage on the client.

3. Out of scope

  • Third-party operator websites (ASFINAG, DARS, NÚSZ, BGTOLL, CNAIR, etc.) — please report those to the operator directly.
  • Issues that require a privileged position (already-compromised browser, malicious browser extension, physical access to the user’s device).
  • Automated-scanner output without a clear, demonstrable security impact.
  • Reports about missing best practices (HTTP header hardening, TLS configuration choices, software-version fingerprinting) where no exploitable risk is shown.
  • Denial-of-service tests, social-engineering against staff or contractors, attacks against physical premises, attacks against third-party providers (hosting, DNS, mail).

4. What to include in the report

  • A short description of the issue and the affected URL or component.
  • Step-by-step reproduction, including the request payload if relevant.
  • The impact you believe the issue has, and a realistic exploitation scenario.
  • The date and time of testing and the browser, tool or script used.
  • Your preferred name (or pseudonym) for public credit, if any (section 8).

5. What we ask of you

  • Do not access, modify or download data that does not belong to you. If a misconfiguration exposes someone else’s data, stop and tell us — do not download more than the minimum needed to evidence the issue.
  • Do not perform denial-of-service tests, social engineering, or attacks against physical premises or third-party providers.
  • Give us a reasonable window to fix the issue before public disclosure (section 7).
  • Operate in good faith. Reports submitted with the genuine intent of improving security are welcome; threats, extortion or demands for payment in exchange for non-disclosure are not.

6. Coordinated timeline — what we commit to

  • Acknowledgement within 5 business days of receipt.
  • Triage (in-scope confirmation, initial severity) within 10 business days.
  • Status updates on material findings at least every 15 calendar days until the report is closed.
  • Remediation within a window proportionate to severity: critical or actively exploited issues are prioritised; standard fixes target 90 calendar days from triage; if more time is required, a justified extension is agreed with you.
  • Public credit when a fix is shipped, if you wish (section 8).

7. Coordinated public disclosure

We follow a coordinated-disclosure model:

  • the report and the fix remain confidential until a remediation is shipped or until the coordinated-disclosure window (default 90 calendar days from triage) has elapsed;
  • the controller and the reporter agree on the wording, attribution and timing of any public advisory;
  • where a finding affects a third party (operator, processor, library), we may extend the window by mutual agreement to allow that party to coordinate its own response;
  • in case of disagreement on timing, the matter may be referred to the CCB (section 9);
  • if you rely on the statutory protection described in section 9, public disclosure also requires the agreement of the CCB.

8. Recognition — no bug-bounty programme at this time

Autovig does not currently run a paid bug-bounty programme. Recognition is via public credit on this page (with your preferred name or pseudonym) and direct correspondence. No commitment to monetary reward is made; if a programme is later introduced, the terms will be published here before any submission can rely on them.

9. Safe harbour and Belgian legal framework

We will not pursue legal action — and will treat your conduct as authorised for the purposes of the relevant computer-misuse provisions of Belgian law — provided that you:

  • act in good faith with the genuine intent of improving security;
  • stay within the scope at section 2 and respect the out-of-scope list at section 3;
  • access only the minimum data necessary to evidence the finding and do not exfiltrate, retain, publish or share third-party data;
  • do not degrade availability, integrity or confidentiality beyond what is strictly necessary to demonstrate the issue;
  • report the finding to the channel at section 1 without unreasonable delay;
  • respect the coordinated-disclosure timeline at section 7.

This authorisation is granted by Autovig in its capacity as controller of the in-scope assets and covers in-scope acts only. It does not bind public authorities or third parties whose systems may be incidentally affected.

Statutory protection. Independently of this authorisation, article 23 of the Belgian Loi du 26 avril 2024 establishing a framework for the cybersecurity of network and information systems (the Belgian NIS2 law) provides that people who report a potential vulnerability under the procedure of its article 22 do not commit certain offences, including unauthorised access to an IT system, provided they meet all of its conditions, in particular:

  • they act without fraudulent intent or intent to harm;
  • they send a simplified notification — the system concerned and a short description of the potential vulnerability — without delay and at the latest within 24 hours of discovering it, both to the organisation responsible (for this Site: security@autovig.eu) and to the CCB;
  • they send a complete notification without delay and at the latest within 72 hours of the discovery, to the same recipients;
  • they do not go beyond what is necessary and proportionate to verify and report the vulnerability;
  • they do not publicly disclose information about the vulnerability without the agreement of the CCB.

The CCB’s CVD page (https://ccb.belgium.be/regulation/cvdp) is the reference for this procedure. The Belgian Criminal Code of 1867 was replaced by a new Criminal Code on 1 September 2026; ask the CCB or a lawyer if you need the offence provisions that now apply.

10. Processing of your personal data

The personal data you transmit when reporting a vulnerability (email address, content of the report, optional PGP-encrypted material) is processed by Autovig as controller under the legal basis of legitimate interest (article 6(1)(f) GDPR), for the purposes of triage, remediation and coordinated public disclosure. Reports are retained for up to 5 years after closure. Your full data-subject rights, the route to the Belgian APD/GBA and the full data-protection disclosures are set out in our Privacy Policy.

Sources

Related legal pages