Vulnerability disclosure policy

1. Who we are and what this policy covers

Invenza is an online application for invoicing, quotes, credit notes and accounting integrations, offered by Ali Eren, sole proprietorship (enterprise number 0742.764.434). This policy covers the Invenza web application and its login service.

2. How to report a vulnerability

Send your report by e-mail to security@invenza.be. Please include:

• a description of the vulnerability and the affected page, URL or component;
• the steps needed to reproduce it, if possible with screenshots or a short proof of concept;
• the impact you expect an attacker could achieve;
• how we can contact you if we have questions.

Only include personal data of others if it is strictly necessary to explain the problem.

3. What you can expect from us

• We confirm receipt of your report within 5 working days.
• We assess the report and keep you informed of our findings and of the progress of the fix.
• We let you know when the vulnerability has been fixed.
• We treat your report and your personal data confidentially and do not share them with third parties without your permission, unless the law requires us to.

4. What we ask of you

• Only test with your own account and your own data. Do not access, change or delete data of others beyond what is strictly needed to demonstrate the vulnerability.
• If you encounter personal data of others, stop, report it to us and delete any copy you made.
• Do not disrupt the service, do not install backdoors or other persistent changes, and do not use the vulnerability further than needed to demonstrate it.
• Do not disclose the vulnerability publicly or to third parties before we have had the chance to fix it. We will agree with you when it can be disclosed.
• Delete any data you obtained during your research once you have reported it.

5. Good faith

If you act in good faith and follow this policy, we will not take legal action against you and will not file a complaint with the authorities about your research. This commitment only binds us; it does not cover services of third parties.

6. Out of scope

The following is not covered by this policy and is not allowed:

• denial-of-service attacks and load or stress tests;
• social engineering or phishing of our users or of us;
• sending spam via the application or its e-mail addresses;
• physical attacks on equipment or premises;
• services of third parties that we use, such as our hosting, e-mail and Peppol providers; report vulnerabilities in those services to the provider concerned;
• reports from automated scanners without a demonstrated security impact.

7. No reward

We do not run a bug bounty programme and do not pay financial rewards for reports. We are, however, grateful for every report that helps us make Invenza more secure.