Responsible Disclosure
At Cube, security and responsible management are top priorities. We do our utmost to deploy secure and responsible systems; however, software and its implementation are never one hundred percent foolproof. What should you do if you discover a bug or security issue in our software? If you find a vulnerability or an unusual bug, we greatly appreciate it when you report it to us. If your report leads to the patching of a vulnerability in an active (customer) environment, you may be eligible for a gift voucher.
How to disclose correctly?
Email your findings to hi@cube.nl
Please try to provide enough information to reproduce the problem, so that we can also find it smoothly. Usually a URL, screenshot, operating system (e.g. Samsung S20 + Chrome) and short description is sufficient.
Try to collect this information without;
Exploiting the problem or leak by downloading, destroying or otherwise editing more than is necessary to demonstrate the problem.
Using attacks on the suspected system, for example through DDoS, spam or third-party applications.
Sharing the problem with others until it is resolved, and any confidential information that may have been obtained is erased.
What happens next?
We will treat your report confidentially and will not share personal data without permission unless there is a legal obligation to do so. Reporting under a pseudonym is then possible.
We will respond to the report within 3 working days, giving an estimate of when we think the problem will be fixed.
We will keep you updated on the progress of the fix.
When the leak is fixed, and any notification about it, we may include your name as the discoverer upon request.
If we patch the discovered vulnerability in an active (customer) environment and this results in improved security for our services, you will be eligible for the gift voucher.
In that case, we will contact you. You’ll receive your reward in the mail, and we’ll be eternally grateful!
If you know exactly how to solve this problem, and would like to come and do so at a Cube desk, don't forget to send your CV along with your notification.