Werktools logo wit
Contact
Werktools logo wit
Plan een demo
Werktools logo wit
Werktools logo wit

Responsible Disclosure

How can I report a vulnerability (Responsible Disclosure)?

You can email any vulnerabilities in a WERKTOOLS SaaS system to the WERKTOOLS Security email address at responsible-disclosure@werktools.com. Report the vulnerability before making it known to the outside world. This allows WERKTOOLS to take measures first. This is called Responsible Disclosure.

What to consider when making a Responsible Disclosure

When reporting a vulnerability in an ICT system, consider the following:
  1. Provide sufficient information to reproduce the problem. This will enable WERKTOOLS to resolve the problem as quickly as possible. Usually, the IP address or URL of the affected system and a description of the vulnerability are sufficient. More information may be needed for more complex vulnerabilities.
  2. Leave your contact details (email address or phone number) so that WERKTOOLS can contact you.
  3. Report the vulnerability as soon as possible after discovering it.
  4. Do not share information about the security issue with others until it has been resolved.
  5. Handle the knowledge about the security issue responsibly. Do not take any actions that go beyond what is necessary to demonstrate the security issue.
Does your report meet these conditions?
If so, WERKTOOLS will not attach any legal consequences to the report.

Do not exploit a weakness in an ICT system. If you discover a vulnerability, do not exploit it. For example, by:

  • installing malware;
  • copying, modifying, or deleting data in a system (an alternative to this is to create a directory listing of a system);
  • making changes to the system;
  • repeatedly accessing the system or sharing access with others;
  • using so-called “brute force” to gain access to systems;
  • using denial-of-service or social engineering.

What Werktools does in the case of Responsible Disclosure

Have you reported a vulnerability in an ICT system?
WERKTOOLS will handle this report as follows:
  1. WERKTOOLS will respond to your report within 3 working days. This response will include an assessment of the report and if appropriate, an expected date for a solution.
  2. WERKTOOLS will keep you, as the reporter, informed of the progress of the problem’s resolution
  3. WERKTOOLS will resolve the security issue as quickly as possible, but no later than within 60 days. Werktools will determine together with you whether and how the reported issue will be communicated. Communication will only take place after the issue has been resolved.
  4. WERKTOOLS has no official bug bounty program, but could offer a reward as a thank you for your help. If you wish, WERKTOOLS can mention your name as the discoverer of a reported vulnerability in the Hall of Fame.
WERKTOOLS treats your report confidentially. WERKTOOLS does not share personal data with third parties without your consent, unless required to do so by law or court order.

Scope

In most cases, we only reward the types of vulnerabilities listed below on our SaaS service on the domains werktools.app and api.werktools.com.
  1. Execution of arbitrary code injection
  2. Escalation of privileges (from unverified user or to administrators)
  3. Bypassing authentication or unauthorized access to data
  4. Cross-site request forgery
  5. Cross-site scripting
  6. Encryption vulnerabilities

 

Exclusions

WERKTOOLS does not award rewards for trivial or unexploitable bugs, nor on known issues found on the website werktools.com. Below are some examples of known vulnerabilities and accepted risks which are excluded from reward.
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages
  • Fingerprinting/version banner disclosure on general/public services
  • Publicly accessible files and folders containing non-sensitive information
  • Clickjacking and related vulnerabilities
  • CSRF on forms that are available without a session (e.g., a contact form/login form)
  • Cross-Site Request Forgery on logout function
  • Presence of “autocomplete” or “save password” functionality
  • Lack of “secure” / “HttpOnly” flags on non-sensitive cookies
  • Weak or circumventable CAPTCHA implementation
  • Brute force on “Forgot Password” page and account lockout not enforced
  • OPTIONS Method enabled
  • Username / Email enumeration by brute force attempts via:
    – Login error messages
    – “Forgot Password” / Password error messages
  • Lack of HTTP Security Headers such as:
    • Strict-Transport-Security
    • X-Frame-Options
    • X-XSS-Protection
    • X-Content-Type-Options
    • Content-Security-Policy, X-Content-Security-Policy, X-WebKit-CSP
  • SSL configuration weaknesses:

     

    • SSL attacks that cannot be exploited from outside
    • SSL “Forward Secrecy” is missing
    • SSL weak and insecure cipher suites
  • Missing HTTP Public Key Pinning (HPKP)
  • SPF, DKIM, DMARC issues
  • Host Header Injection
  • Content Spoofing / Text Injection on 404 pages
  • Reporting old software versions without proof of concept or working exploit
  • Leaking information in Metadata
  • Missing DNSSEC
  • Expired or inactive domains (domain takeover)
  • Same Site Scripting / localhost DNS record

 

References