Responsible Disclosure Policy

At TenderB, we take the security of our systems very seriously and we appreciate the contribution of security researchers to make our platforms even more secure. If you have discovered a security problem, we greatly appreciate it if you report it to us responsibly so that we can take timely action.

What we ask of you:

• Email your findings to security@tenderb.com
• Please provide enough information to reproduce the problem so we can fix it as soon as possible
• Avoid privacy violation, data destruction and disruption of our services
• Wait to publish until the problem is resolved
• Do not use social engineering or DDoS attacks
• Do not use attacks on physical security or third-party applications
• Do not make any system changes

What we promise:

• We will respond to your report within 3 business days
• We treat your report confidentially and do not share personal information without your consent
• We will keep you informed about the progress of solving the problem
• We solve the security problem as soon as possible
• In our communication about the problem, we mention you as the discoverer if you wish
• We promise a listing on our Hall of Fame upon a relevant find

What is included in the scope:

• TenderB SaaS platforms (*.tenderb.com)
• TenderB API endpoints
• TenderB web applications
• TenderB mobile applications

What is not included in the scope:

• Denial of Service attacks
• Spamming
• Social engineering
• Attacks on physical security
• Third-party applications/systems
• Problems already known through previous reports
• Theoretical security problems without practical effect

Legal Framework:

We will not take legal action against you if you comply with the above conditions. We reserve the right to take legal action when:

• There is data sharing with third parties
• There is publication before the problem is solved
• There are activities beyond what is reasonably necessary to demonstrate the security problem
• There is the use of social engineering or DDoS attacks

Reward:

TenderB does not have a bug bounty program. However, we may offer a listing on our Hall of Fame and/or provide a token reward for substantial findings.

How to report:

1. Send an email to security@tenderb.com

2. Use PGP encryption if possible (our public key is available on our website)

3. Give a detailed description of the problem

4. State possible impact of the security problem

5. Add any technical details and reproduction steps

6. Add your contact information for further communication

We appreciate your help in keeping TenderB and our users safe.

*This policy may be updated from time to time. Please check back periodically for changes.*

Last updated: 8-2-2025

Version: 1.0

Owner: Alex de Ruiter