Responsible disclosure
Conditions of use
SNCB-NMBS attaches great importance to the security of its networks and information systems, in particular by ensuring the protection of customer data. Despite all the security measures that are taken, it cannot be ruled out that there are still vulnerabilities in the system which could be misused. If you determine a security issue in our networks and/or systems, we provide the possibility of warning us of this matter in a sensible way, in order to solve the issue quickly. To ensure that this process is conducted in an organized and secure manner, we request you to adhere to the following rules.
To view the full guidelines, legal terms and conditions, and the official reporting form (Appendix 1), please click here to read our responsible disclosure policy.
| Name | Alias | |
| Vincent Cox | vincentcox | - |
| Jarne Peelman | Jarne Peelman | @Jarne Peelman |
| Vincent Schrooten | - | @pocketvince |
If you think you have discovered a security vulnerability, please report it to SNCB-NMBS so that we can investigate the issue.
- How do I report a problem? Send an email to [email protected].
- You can submit a report in French, Dutch or English.
- Protect your message
- If your report contains sensitive information, encrypt your email using our PGP key. Use it to encrypt your message before sending it. This ensures that only our security team can read your report.
- If your report contains sensitive information, encrypt your email using our PGP key. Use it to encrypt your message before sending it. This ensures that only our security team can read your report.
- What information should I include in my report? To help us understand and resolve the issue quickly, please include the following information:
- A clear description of the iussue;
- The steps required to reproduce the issue (if possible);
- Relevant details such as:
- IP addresses;
- logs;
- screenshots;
- URLs;
- Your contact details (so that we can get back to you or contact you if necessary). If you prefer to remain anonymous, you can use an anonymous email service.
- You may also use the official reporting form (Appendix 1) provided in our coordinated vulnerability disclosure policy. This ensures that all the required information is included.
- Please follow and apply the disclosure guidelines:
- Do not disclose this vulnerability publicly or to third parties before it has been fixed;
- Only access the data strictly necessary to demonstrate the issue;
- Do not exploit this vulnerability (for example, no data extraction, system disruption or attacks);
- Do not modify or delete any data;
- Do not compromise the system’s availability or performance.
- If testing proves necessary, we (SNCB-NMBS) will carry it out.
You can report vulnerabilities in our security.
It concerns any vulnerability, which could be misused for illicit purposes, that can be found on :
- One of our websites:
- Our mobile and web applications
- Our networks and information systems
- Questions and complaints regarding the products and services of SNCB-NMBS.
- Questions about the use of your passwords.
- Questions about spam or phishing (attempts).
- We will give you an answer within two weeks.
- We will contact you again if we need any additional information.
- We make every effort to solve the issue quickly and efficiently.
- We will inform you as soon as the issue has been solved.
- The reward we currently award is adding individuals to our Wall of fame. Here you can then find you name, Alias, Twitter's name. We decide autonomously and case by case on the awarding of this reward.
- If your actions meet the above criteria, we will not bring any legal proceedings against you.
