Home
Legals
Responsible Disclosure

Responsible Disclosure

The following systems are covered by the Fundaments responsible disclosure policy:

  • portal.fundaments.nl
  • ots.fundaments.nl

Subdomains are excluded from this policy.
We would like to work with you to better protect our customers and our systems.

‍

We ask that you‍

  • Email your findings to sec@fundaments.nl;
  • Do not abuse the issue by, for example, downloading more data than necessary to demonstrate the leak, or viewing, deleting, or modifying third-party data;
  • Do not share the issue with others until it is resolved, and delete all confidential data obtained through the leak immediately after it has been patched;
  • Do not use physical security attacks, social engineering, distributed denial of service, spam, or third-party applications;
  • Provide sufficient information to reproduce the issue so we can resolve it as quickly as possible. Usually, the IP address or URL of the affected system and a description of the vulnerability are sufficient, but more may be required for complex issues;
  • Submissions must result from human research and analysis; reports generated or written by automated tools will not be accepted.

‍

What we promise

  • We aim to respond to your report within 3 business days with our assessment and an expected resolution date. No feedback or follow-up will be provided for trivial or low-impact reports;
  • We will treat your report confidentially and will not share your personal data with third parties without your consent, unless required by law. Reporting under a pseudonym is possible;
  • We will keep you informed of the progress in resolving the issue;
  • In any communications regarding the reported issue, we will mention your name as the discoverer if you wish;
  • We may provide a reward for your research, but we are not obligated to do so. You are not automatically entitled to compensation. The form of this reward is not fixed and is determined by us on a case-by-case basis. Whether we provide a reward and its form depends on the thoroughness of your research, the quality of the report, and the severity of the vulnerability;
  • We strive to resolve all issues as quickly as possible and would like to be involved in any publication about the issue after it has been resolved;
  • If you have complied with the above conditions, we will not take legal action against you regarding the report.

‍

Out of scope

Fundaments does not provide rewards for trivial vulnerabilities or bugs that cannot be exploited. Below are examples of known vulnerabilities and accepted risks that fall outside this policy:

  • HTTP 404 codes or other non-HTTP 200 codes
  • Clickjacking on pages without a login function
  • Missing SPF, DKIM, and DMARC records
  • Reporting older software versions without a proof of concept or working exploit.

This responsible disclosure policy is based on an example written by Floor Terra and the NCSC's Responsible Disclosure Guideline.

Necessary

Necessary cookies help make a website more usable by enabling basic functions such as page navigation and access to secure areas of the website. Without these cookies, the website cannot function properly.

Name
Provider
Goal
Expiration period
Type
Name
tTf
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tTE
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tTDu
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tTDe
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tPL
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tnsApp
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tC
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tAE
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tADu
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
tADe
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
t3D
Provider

www.fundaments.nl

Goal

This cookie is associated with a bundle of cookies used to retrieve and display content. These cookies maintain the correct state for fonts, blogs, photo slides, color themes, and other website settings.

Expiration period
Persistent
Type
HTML Local Storage
Name
rc::c
Provider

Google

Goal

This cookie is used to distinguish between humans and bots.

Expiration period
Session
Type
HTML Local Storage
Name
rc::a
Provider

Google

Goal

This cookie is used to distinguish between humans and bots. This helps the website generate accurate reports on site usage.

Expiration period
Persistent
Type
HTML Local Storage
Name
CraftSessionId
Provider

www.fundaments.nl

Goal

Sets a unique ID for the session. This allows the website to collect data on visitor behavior for statistical purposes.

Expiration period
Session
Type
HTTP Cookie
Name
CRAFT_CSRF_TOKEN
Provider

www.fundaments.nl

Goal

Ensures browsing security by preventing cross-site request forgery. This cookie is essential for the security of the website and the visitor.

Expiration period
Session
Type
HTTP Cookie
Name
collect
Provider

Google

Goal

Used to send data to Google Analytics regarding the visitor's device and behavior. Tracks the visitor across devices and marketing channels.

Expiration period
Session
Type
Pixel Tracker
Name
ads/ga-audiences
Provider

Google

Goal

Used by Google AdWords to re-engage visitors who are likely to convert into customers based on their online behavior across various websites.

Expiration period
Session
Type
Pixel Tracker
Name
_gid
Provider

www.fundaments.nl

Goal

Registers a unique ID used to generate statistical data on how the visitor uses the website.

Expiration period
1 day
Type
HTTP Cookie
Name
_gat
Provider

www.fundaments.nl

Goal

Used by Google Analytics to throttle request rate

Expiration period
1 day
Type
HTTP Cookie
Name
_ga
Provider

www.fundaments.nl

Goal

Registers a unique ID used to generate statistical data on how the visitor uses the website.

Expiration period
2 years
Type
HTTP Cookie
Preferences

Preference cookies allow a website to remember information that influences the behavior and design of the website, such as your preferred language or the region where you live.

Name
Provider
Goal
Expiration period
Type
Name
lang [x2]
Provider

LinkedIn

Goal

Remembers the language version selected by the user on a website

Expiration period
Session
Type
HTTP Cookie
Statistics

Statistical cookies help website owners understand how visitors use their websites by collecting and reporting data anonymously.

Name
Provider
Goal
Expiration period
Type
Name
p.gif
Provider

Adobe Inc

Goal

Tracks special fonts used on the website for internal analysis. The cookie does not record visitor data.

Expiration period
Session
Type
Pixel Tracker
Marketing

Marketing cookies are used to track visitors when they visit different websites. Their goal is to gather information that is tailored to and relevant to the individual user. This information becomes more valuable to us.

Name
Provider
Goal
Expiration period
Type
Name
yt-remote-session-name
Provider

YouTube

Goal

Stores the user's video player preferences for embedded YouTube videos

Expiration period
Session
Type
HTML Local Storage
Name
yt-remote-session-app
Provider

YouTube

Goal

Stores the user's video player preferences for embedded YouTube videos

Expiration period
Session
Type
HTML Local Storage
Name
yt-remote-fast-check-period
Provider

YouTube

Goal

Stores the user's video player preferences for embedded YouTube videos

Expiration period
Session
Type
HTML Local Storage
Name
yt-remote-device-id
Provider


YouTube

Goal

Stores the user's video player preferences for embedded YouTube videos

Expiration period
Persistent
Type
HTML Local Storage
Name
yt-remote-connected-devices
Provider

YouTube

Goal

Stores the user's video player preferences for embedded YouTube videos

Expiration period
Persistent
Type
HTML Local Storage
Name
yt-remote-cast-installed
Provider

YouTube

Goal

Stores the user's video player preferences for embedded YouTube videos

Expiration period
Session
Type
HTML Local Storage
Name
YSC
Provider

YouTube

Goal

Registers a unique ID to keep statistics on which YouTube videos the user has seen.

Expiration period
Session
Type
HTTP Cookie
Name
VISITOR_INFO1_LIVE
Provider

YouTube

Goal

Tries to estimate the users' bandwidth on pages with integrated YouTube videos.

Expiration period
179 days
Type
HTTP Cookie
Name
UserMatchHistory
Provider

LinkedIn

Goal

Used to track visitors across multiple websites to display relevant advertisements based on the visitor's preferences.

Expiration period
29 days
Type
HTTP Cookie
Name
test_cookie
Provider

Google

Goal

Used to check if the user's browser supports cookies.

Expiration period
1 day
Type
HTTP Cookie
Name
lissc
Provider


LinkedIn

Goal

Used by the social networking service LinkedIn to track the use of embedded services.

Expiration period
1 year
Type
HTTP Cookie
Name
lidc
Provider

LinkedIn

Goal

Used by the social networking service LinkedIn to track the use of embedded services.

Expiration period
1 day
Type
HTTP Cookie
Name
IDE
Provider

Google

Goal

Used by Google DoubleClick to record and report website user actions after viewing or clicking on one of the advertiser's ads, with the purpose of measuring ad effectiveness and presenting targeted ads to the user.

Expiration period
1 year
Type
HTTP Cookie
Name
hubspotutk
Provider

www.fundaments.nl

Goal

Tracks a visitor's identity. This cookie is sent to the HubSpot marketing platform upon form submission and is used to de-duplicate contacts.

Expiration period
1 year
Type
HTTP Cookie
Name
GPS
Provider

YouTube

Goal

Registers a unique ID on mobile devices to enable tracking based on geographical GPS location.

Expiration period
1 day
Type
HTTP Cookie
Name
embed/v3/counters.gif
Provider

HubSpot

Goal

Collects information about user preferences and/or interaction with web campaign content. This is used on the CRM campaign platform that website owners use to promote events or products.

Expiration period
Session
Type
Pixel Tracker
Name
bscookie
Provider

LinkedIn

Goal

Used by the social networking service LinkedIn to track the use of embedded services.

Expiration period
2 years
Type
HTTP Cookie
Name
bcookie
Provider


LinkedIn

Goal

Used by the social networking service LinkedIn to track the use of embedded services.

Expiration period
2 years
Type
HTTP Cookie
Name
__ptq.gif
Provider


HubSpot

Goal

Sends data to the HubSpot marketing platform regarding the visitor's device and behavior. Tracks visitors across devices and marketing channels.

Expiration period
Session
Type
Pixel Tracker
Name
__hstc
Provider

www.fundaments.nl

Goal

Collects statistical data regarding the user's website visits, such as the number of visits, average time spent on the website, and which pages have been loaded. The purpose is to segment website users based on factors such as demographics and geographic location, allowing media and marketing agencies to structure and understand their target audiences to facilitate customized online advertising.

Expiration period
1 year
Type
HTTP Cookie
Name
__hssrc
Provider

www.fundaments.nl

Goal

Collects statistical data regarding the user's website visits, such as the number of visits, average time spent on the website, and which pages have been loaded. The purpose is to segment website users based on factors such as demographics and geographic location, allowing media and marketing agencies to structure and understand their target audiences to facilitate customized online advertising.

Expiration period
Session
Type
HTTP Cookie
Name
__hssc
Provider

www.fundaments.nl

Goal

Collects statistical data regarding the user's website visits, such as the number of visits, average time spent on the website, and which pages have been loaded. The purpose is to segment website users based on factors such as demographics and geographic location, allowing media and marketing agencies to structure and understand their target audiences to facilitate customized online advertising.

Expiration period
1 day
Type
HTTP Cookie

Neem contact met ons op