VULNERABILITY DISCLOSURE POLICY

Help us stay secure.

We welcome reports from the security research community. This policy describes how to report, what we commit to, and the rules of engagement.

Found a vulnerability?

Send your findings to security@badex.app with enough detail for us to reproduce the issue.

📧 Email security@badex.app

Our process

  1. 1
    Acknowledgment
    We confirm receipt within 2 business days, and as soon as possible for critical issues.
  2. 2
    Triage & Verification
    We reproduce the issue and assess its severity using CVSS 3.1.
  3. 3
    Fix
    We develop, test and deploy a fix, and keep you informed of progress.
  4. 4
    Customer Notification
    If personal data is affected, we notify the supervisory authority and affected customers as required by GDPR (Articles 33–34).
  5. 5
    Disclosure
    We agree the timing of any public disclosure with you after the fix is deployed. Credit on request.

Severity & target response times

Severity Acknowledgment Fix target Examples
Critical As soon as possible 7 days Remote code execution, authentication bypass, exposure of customer data
High 2 business days 14 days Privilege escalation, sensitive data leak, stored XSS with admin impact
Medium 2 business days 30 days IDOR, reflected XSS, business logic flaws
Low 5 business days 90 days Low-impact information disclosure, minor configuration issues

✓ In scope

  • •Badex products on *.badex.app (signature.badex.app, invoice.badex.app, support.badex.app)
  • •Authentication and authorisation flows
  • •Separation of customer data between accounts
  • •Public API endpoints of our products
  • •Microsoft 365 OAuth integration

✗ Out of scope

  • •Denial of Service (DoS/DDoS) and load testing
  • •Social engineering, phishing or physical attacks
  • •Issues in third-party services (Microsoft, Cloudflare, …) — report those to the vendor
  • •Findings without demonstrated security impact (e.g. missing headers alone)
  • •Self-XSS or attacks requiring physical access to a victim's device
  • •Spam, mass account creation or automated scanning that degrades service

Safe harbour — Belgian legal framework

Badex will not take legal action against researchers who act in good faith and follow this policy. Belgian law provides a legal framework for ethical hacking (coordinated vulnerability disclosure), described by the Centre for Cybersecurity Belgium (CCB) at ccb.belgium.be. Under that framework you may also inform the CCB of your report.

We consider your research in good faith when you:

  • •act without fraudulent intent or intent to cause harm;
  • •report the vulnerability to us as soon as possible;
  • •only access or use data as far as necessary to demonstrate the vulnerability, and do not copy, modify or delete data;
  • •do not disrupt our services or the services of our customers;
  • •keep the vulnerability confidential until we have fixed it and agreed on disclosure.

Badex does not run a paid bug bounty programme.