Responsible Disclosure Policy
1 May 2026
24 May 2026
Introduction
BEEShop takes the security of our systems and user data seriously. We value the contributions of security researchers and the broader security community in helping us maintain a secure platform.
Scope
This policy applies to the following BEEShop-owned systems:
- beeshop.app — marketing website
- app.beeshop.app — user-facing application
- admin.beeshop.app — administration panel
Only systems owned and operated by BEEShop are in scope. Third-party services, even if linked from our platform, are not covered by this policy.
How to Report
If you have discovered a security vulnerability, please report it to us via email:
Email: security@beeshop.app
Please include the following information in your report:
- Description of the vulnerability and its potential impact
- Detailed steps to reproduce the issue
- Proof-of-concept (if available)
- Your assessment of the severity
- Your contact information for follow-up
A PGP key is available on request for encrypted communication.
Our Commitments
When you report a vulnerability in good faith, we commit to:
- Acknowledge your report within 3 business days
- Provide an initial assessment within 10 business days
- Keep you informed of our progress toward resolution
- Not pursue legal action against good-faith security researchers who comply with this policy
- Credit you publicly (if desired) once the vulnerability is resolved
Rules of Engagement
When conducting security research, you must:
- Not access, modify, or delete data belonging to other users
- Not perform denial-of-service (DoS) attacks
- Not publicly disclose the vulnerability before 90 days have elapsed or a fix is deployed (whichever comes first)
- Not violate the privacy of other users
- Only test using your own accounts
- Not conduct excessive automated scanning that could degrade service performance
Out of Scope
The following are not considered valid security vulnerabilities under this policy:
- Social engineering attacks (phishing, pretexting)
- Physical security issues
- Denial-of-service (DoS/DDoS) attacks
- Spam or bulk messaging
- Vulnerabilities in third-party services
- Attacks requiring physical device access
- Missing security headers without a demonstrable exploit
- Software version disclosure without an associated vulnerability
Legal Safe Harbour
Security research conducted in compliance with this policy is:
- Authorised under Belgian Penal Code Article 550bis (computer crime provisions)
- Exempt from anti-circumvention provisions
- Not subject to legal action by BEEShop
This policy is aligned with the NIS2 Directive (EU) 2022/2555 regarding coordinated vulnerability disclosure.
Response Timeline
| Stage | Timeline |
|---|---|
| Acknowledgement | 3 business days |
| Initial assessment | 10 business days |
| Status update | Every 14 days |
| Resolution — Critical | 7 days |
| Resolution — High | 30 days |
| Resolution — Medium | 60 days |
| Resolution — Low | 90 days |
Contact
For security vulnerability reports:
Email: security@beeshop.app
For non-security enquiries:
Email: contact@beeshop.app