** Vulnerability Disclosure Policy
   (of systems managed by Walter Belgers for himself or FRTN B.V.)

* Introduction

I welcome feedback from security researchers and the general
public to help improve our security. If you believe you have
discovered a vulnerability, privacy issue, exposed data, or other
security issues in any of our assets, I want to hear from you.
This policy outlines steps for reporting vulnerabilities to me,
what I expect, what you can expect from me.

* Systems in Scope

This policy applies to any digital assets on the following IP space:
IPv4: 213.206.252.30 - 213.206.252.41
IPv6: 2001:4018:1400:2::/96
There are several DNS domains involved.

* Out of Scope

Assets or other equipment not owned by parties participating in this
policy (i.e. me). Note that one of the domains pointing to the IP space
in scope is gigatron.io/gigatronttl.eu, which has an entry
forum.gigatron.io/forum.gigatronttl.eu residing in a different IP space
(which is thus out of scope).

Vulnerabilities discovered or suspected in out-of-scope systems
should be reported to the appropriate vendor or applicable authority.

* My Commitments

When working with us, according to this policy, you can expect me to:

- Respond to your report promptly, and work with you to understand and
  validate your report;
- Strive to keep you informed about the progress of a vulnerability
  as it is processed;
- Work to remediate discovered vulnerabilities in a timely manner,
  within my operational constraints (note I am doing this in my spare
  time and not as a job); and
- Extend Safe Harbor for your vulnerability research that is related
  to this policy.

* My Expectations

In participating in my vulnerability disclosure "program" in good
faith, I ask that you:

- Play by the rules, including following this policy and any other
  relevant agreements. If there is any inconsistency between this
  policy and any other applicable terms, the terms of this policy
  will prevail;
- Report any vulnerability you’ve discovered promptly;
- Avoid violating the privacy of others, disrupting our systems,
  destroying data, and/or harming user experience;
- Use only the Official Channels to discuss vulnerability information
  with me;
- Provide me a reasonable amount of time (at least 90 days from the
  initial report) to resolve the issue before you disclose it publicly;
- Perform testing only on in-scope systems, and respect systems and
  activities which are out-of-scope;
- If a vulnerability provides unintended access to data: Limit the
  amount of data you access to the minimum required for effectively
  demonstrating a Proof of Concept; and cease testing and submit a
  report immediately if you encounter any user data during testing,
  such as Personally Identifiable Information (PII), Personal Healthcare
  Information (PHI), credit card data, or proprietary information;
- You should only interact with test accounts you own or with
  explicit permission from the account holder; and
- Do not engage in extortion.

* Official Channels

Please report security issues via e-mail to one of the addresses
associated with the GPG key as pointed to in the security.txt file,
providing all relevant information. The more details you provide, the
easier it will be for me to triage and fix the issue. 

* Safe Harbor

When conducting vulnerability research, according to this policy,
I consider this research conducted under this policy to be:

- Authorized concerning any applicable anti-hacking laws, and I
  will not initiate or support legal action against you for accidental,
  good-faith violations of this policy;
- Authorized concerning any relevant anti-circumvention laws, and
  I will not bring a claim against you for circumvention of technology
  controls; and
- Lawful, helpful to the overall security of the Internet, and
  conducted in good faith.

You are expected, as always, to comply with all applicable laws.
If legal action is initiated by a third party against you and you
have complied with this policy, I will take steps to make it known
that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your
security research is consistent with this policy, please contact
me before going any further.

Note that the Safe Harbor applies only to legal claims under the
control of the organization participating in this policy, and that
the policy does not bind independent third parties.

* Bug Bounty

There is no bug bounty program.