English

Coordinated Vulnerability Disclosure

At Rijk Zwaan Zaadteelt and Zaadhandel B.V., we consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.

If you discover a vulnerability, we would like to know about it so we can take steps to address it as quickly as possible. We would like to ask you to help us better protect our clients and our systems. 


We ask you:

  • To email your findings to security@rijkzwaan.com. Please encrypt your findings using our PGP key to prevent this critical information from falling into the wrong hands. The PGP is listed at the bottom of this page. 
  • Provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.
  • Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying other people's data.
  • Keep the problem secret and not share it with others until it is solved.
  • Immediately erase all confidential data obtained through the breach. 
  • Do not use attacks on physical security, social engineering or hacking tools like vulnerability scanners.

What we promise:

  • We will respond to your report as soon as possible with our evaluation of the report and an expected resolution date.
  • If you have followed the instructions above, we will not take any legal action against you concerning the report.
  • We will handle your report with strict confidentiality, and not pass on your personal details to third parties without your permission, unless required to be disclosed by law or by order of the Court. Reporting under a pseudonym is possible.
  • We will keep you informed of the progress towards resolving the problem.
  • As a gesture of our gratitude for your assistance, we offer a reward for every report of a security problem that was not yet known to us. The reward will be determined by us based on the severity of the breach and the quality of the report.

Privacy

Rijk Zwaan will treat your report confidentially. The contact information is only used to keep you informed about above matters. Rijk Zwaan does not share personal data with third parties without your permission, unless law or a court decision requires this. 

 

Exclusions

Below are examples of known vulnerabilities and accepted risks that are out of scope of the policy and are therefore not taken into consideration:

 

  • HTTP 404 codes/ pages or other HTTP codes/ pages and Content Spoofing/ text injection on these pages.
  • Report of outdated software or upgrade possibility without sharing the associated proof of concept of a working exploit.
  • Systems and protocols that can be abused for a DDoS attack.
  • Issues with SSL configurations:
    • SSL forward secrecy disabled.
    • Weak/ insecure cipher suites. 
  • Anything related to HTTP security headers, for example:
    • Strict-Transport-Security.
    • X-Frame Options.
    • X-XSS-Protection.
    • X-Content-Type-Options.
    • Content-Security Policy.

Our PGP key

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQGNBGHATwIBDADMJEy8CZXy6/wed4xvdKN2up54DGjDjDPXMCN3YeKN2q18JqrO
SqG87RbH049YN0i9H16PxMn1GE9Mj1Fyn+FgSsQ4zSKue1D+eVcxOp4oBnnhX+ko
DGqARxLstNmFc76GmAML2B/Izl+8sONmtbe4X3UGYtBbNP2pf2QnFs8csnZTBDWb
LGDLoK2FngaM809E0qOsP7YtwHnEe4pUfyfcK6KuFWHBxV68zLMNWZVgB3K++2mX
dqhctvCM4gX8kGYAO0CCuAPCjjmA4ZCHonv3aXFHiPc6eQAXRg61tWHyt4ecONvT
BwARRIrWD3WP0GlX32MMfW50ojXSijrZYuzNdtYrpOVI+yYCrqVE/o3dnG71C3y4
bcqHsvNWj8kqJQHqkXvTYCrxp8f/FNZgGsXaSoLk7NKq2DQlyHZ22d8qycbYu3AK
IqqmyG3D/Zw67iPN2Yo8gyMh5DSPsu5pKZC4IEQj+XBHBJh2RJfdztgGXuFhoBEh
/45+Om02Dk/QQ80AEQEAAbQmU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAcmlqa3p3
YWFuLmNvbT6JAdQEEwEIAD4WIQQqjUbooD5xJ1X5wqIXjI7QQ6o+NQUCYcBPAgIb
AwUJAeFGrgULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAXjI7QQ6o+NWOIDACo
fQepZFkszGQZr4ZT8cxPSqINbOlhsqX69Iyr8khfvsAtkE3TMDklOFaNYa8OHgzL
R3V1g9V6pNyzDmOnJS1YXDVPbTmZIWQhjjPZAYN6dQoqnD24lD0num37lp+dRLi9
DIraUwr6gX7hhx0Xkz/zknzOCRglKbf5FLI+xIZvqMd//KCNPKEl5VKwNdjahoOu
rMKeUBxgzy+kYo1fizyZt+qK1UdQYluUbDwrSxJ4UKrQyTuL4OpvvgeYTSmb9Gnb
N/kv5o8lKe1HynHEMA1PV8e3tl3yYW7QmNon7su22biJyjZs3uRtRj8uZlzlAsJo
h3UhrvlZ/0qkbCJSNDY7b2e70Lbo0v2gKQOailP8XGuZxEpbWfIyuqeX6wZtFMlf
Mt6zwkUFfor4JjkgfKfgyOklR8qwiysUYvJVO4W3tlFN3Fi1Q6t/mdf16Pt+TD5Z
tg+QwnqUzDYVmaqDH/q46SyMyDDmiFFWl5gsGw7jTcUFwLVuKq/6yvESvQEiCju5
AY0EYcBPAgEMAL7cKqbJ6S41Nu+Q1s+dt/prv4TRSbMJOcrgix2M1TcKnxUZT1m8
X7TSf+XTrdLHWI57Y8noebrH312aFiAZgs4IageLEzo0mI/feaWQndGaTWCeQZVc
Hlcmm96N/jv9fAuUnz6jVapGNZRUWy+BrK48cm2xXKlALpu/vBKiy1onOQ3Vv6Op
fqZHf1alzahQvp+2Xqc8mqopJIprbRPOsedIfcGOtEr+/RS/K6eGDL8mibj3npne
umDtE3Xr6GseOVkT7+4/bPznXVLLkV7tpik1bmjzjM9yOiCAngWkRIVrf0Cj7QWz
5DjbrqIRhp5XmXg20kiziHVhmRz2X4I558dYGviQ0IA5h6VdLnuZnhi6WgHK2G03
a1+RYzM48dAmPYC8bCTawgImzpMfwzZcjjS5Wv31FlZKIT8C/VEJZBEd0fktNJRz
bdfHtecrtJWx6cToX0RNHuIrBkGyqf6iOzioAENOGe3U1gvYY108Le5iZNUCupz1
q1eDcQ6lQViqaQARAQABiQG8BBgBCAAmFiEEKo1G6KA+cSdV+cKiF4yO0EOqPjUF
AmHATwICGwwFCQHhRq4ACgkQF4yO0EOqPjWrbwv/btjvB1mwah/pNpM5eJsKz/3T
XzThkwpnVh1hruyqaoSi0cBWtQAzzjpmZRcv9qBecLmIaK/anMkoYP2g0WKBQ4Qh
ti7HwTjOCJIJ1mlZ/DgWvuBrxlTlCRt3b+L3Lj6KK1jW/qGC6yAWxXxSJECroqy7
ERmB7KJEE/DQfBOwcyXyry2qJJepzvL1YUV6SUKaIcXJ5dAAGlV09rKysvQ2B8ns
/hw0lUmXzHpZxn3/2q0ffQVmbCmxWBvoskOQnxoTOEbxnKi3zkhiG/RWSz2Dx+rp
B26vsDezXRxufIoUw92YQjq0RgqgNPyiT0HNFnWn6VAx0CGNLxfFChYhv7sp490/
MN4vrJ3lnyyjT87J3laAkS6cgVyJYPoCkt83hLiZLfwiUTkJnFSf2FVJFZphLkQM
/RZikhD/h8ol4wEvP84hsAxXod9UGNm8CDPaxLHaqCBFNlfPXn14JFGGu1ihNAom
tz1/q57z+DAA5+6A+axs8dU7x6pcx0xnIY5wcqrl
=tLGy
-----END PGP PUBLIC KEY BLOCK-----
 

Version 1.1 of 22 March 2022