If you believe you have found a vulnerability in one of our services, tell us. This policy applies to all services of Viertron Install B.V., trading as Woon IoT: CRA-Portal, CRAIA, Ring AI, Situara, Controll, WatchScreen, Souffleur, CrisisKluis, Eccego, Digital Strom Smart and dstrom.nl Cloud.

Where to report

info@wooniot.nl, with “vulnerability” in the subject. Encryption is welcome; ask us for a key first. This route is also listed in the security.txt on all our domains.

What we do

• Within three working days we confirm we received your report.
• Within ten working days we tell you whether we can reproduce it and how we assess it.
• We keep you informed until it is fixed, and tell you when that happened.
• If the vulnerability turns out to be actively exploited, the reporting deadlines of article 14 of the Cyber Resilience Act apply to us: an early warning within 24 hours and an incident notification within 72 hours to the designated authority.
• We are happy to credit you. We are equally happy to keep you anonymous.

What we ask of you

• Give us reasonable time to fix it before going public. We use 90 days as a guideline and will talk to you if it takes longer.
• Do not change, delete or copy anyone else’s data, and go no further into the systems than needed to demonstrate the problem.
• Do not use attacks that take the service down or disturb other users.
• No social engineering, and do not target our staff or suppliers.

What we do not do

We pay no bounty. If you stay within the above, we will not take legal action against you.

What you need not report

Findings from an automated scan without demonstrated impact, missing security headers without a working scenario, and issues that only occur on outdated browsers.

For our customers

If you are a manufacturer and need to set up your own reporting route for article 14, see the page on the reporting duty. What we recommend to you, we run ourselves.

Ask the CRA assistant

CRA Assistent
Questions about the Cyber Resilience Act

×

Hello, I am the CRA assistant. Ask me anything about the Cyber Resilience Act, about roles and obligations, or about using CRA-Portal.