Home / Coordinated Vulnerability Disclosure

Security

Coordinated Vulnerability Disclosure

Currence iDEAL takes the security of its systems seriously. Even so, no system is perfect — if you find a weakness, we’d like to hear about it so we can fix it quickly and keep working with you to protect our customers.

How to report a vulnerability

If you believe you’ve found a security issue in one of our systems, please report it to us directly rather than disclosing it publicly. To help us handle your report quickly and safely, we ask that you:

  • Send your findings to security@ideal.nl.
  • Encrypt sensitive details using the PGP public key published at ideal.nl/.well-known/pgp.asc.
  • Include the word “CVD” in the subject line of your email.
  • Avoid exploiting the issue beyond what’s needed to demonstrate it — don’t download more data than necessary, and don’t view, modify, or delete data belonging to others.
  • Keep the issue confidential until it has been resolved, and delete any data you accessed as soon as the fix is in place.
  • Don’t use physical attacks, social engineering, denial-of-service techniques, spam, or third-party tools against our systems or people.
  • Include enough detail for us to reproduce the issue — typically the affected URL or IP address plus a description is enough, though more complex issues may need more.
  • Keep your report within the scope listed below.

Scope

We can only act on reports concerning the following domains:

  • www.ideal.nl
  • api.ideal.nl
  • profile.ideal.nl
  • pay.ideal.nl
  • tx.ideal.nl
  • cms.ideal.nl
  • *.currenceplatform.nl (excluding dev*.currenceplatform.nl)

What you can expect from us

  • An initial response within two weeks, including our assessment and an estimated timeline for a fix.
  • No legal action against you for a report made in line with the guidelines above.
  • Confidential handling of your report — we won’t share your personal details with third parties without your consent unless legally required, and you're welcome to report under a pseudonym.
  • Regular updates on our progress resolving the issue.
  • Public credit as the discoverer, if you’d like that.
  • A symbolic reward for previously unknown, relevant reports, based on the severity of the issue and the quality of your report.

We aim to resolve every reported issue as quickly as we reasonably can, and we’d like to coordinate with you on any public write-up once it’s fixed.