Coordinated Vulnerability Disclosure Policy

06 NOV. 2026

APB attaches great importance to the security of its information systems and of the data of its members, customers and partners.

Objectives

APB attaches great importance to the security of its information systems and of the data of its members, customers and partners. Despite the measures in place, a vulnerability may remain.

This Coordinated Vulnerability Disclosure (CVD) policy invites anyone who discovers, in good faith, a vulnerability in APB’s systems to report it to us. It sets out the rules the reporter must follow and APB’s commitments, so that the vulnerability can be fixed before any disclosure.

This policy applies exclusively to technical security vulnerabilities. It is not a channel for reporting alleged non-compliance with laws, regulations or standards (e.g. GDPR, cookie legislation, accessibility requirements), nor for general complaints or requests.

Scope

  • websites and online services operated by APB under the apb.be, pharmacie.be, apotheek.be, mfk-qmp.be, ipheb.be, intelacy.be and farmaflux.be domains and their subdomains;
  • applications and interfaces (APIs) made available by APB to its members, customers and partners.
  • third-party services and products used by APB (e.g. cloud platforms, off-the-shelf software): report the vulnerability directly to the vendor or supplier concerned;
  • internal systems not exposed to the Internet, laboratory equipment and APB premises;
  • findings without demonstrable security impact (e.g. a missing security header without an exploitation scenario, version banners, raw output of an automated scanning tool).
  • alleged non-compliance with legal, regulatory or contractual obligations (e.g. GDPR, ePrivacy/cookie rules, accessibility, consumer law) that does not result from a demonstrable technical vulnerability. Such matters, including data subject requests and privacy concerns, must be addressed to APB’s Data Protection Officer through the contact details published in APB’s privacy policy, and will not be handled under this policy.

Terms and Definitions

A weakness, susceptibility or flaw of an ICT product or ICT service that can be exploited by a cyber threat. A presumed breach of a legal or regulatory obligation is not, in itself, a vulnerability within the meaning of this policy.

Any natural or legal person who reports a vulnerability to APB under this policy.

Process by which the reporter and APB work together to fix a vulnerability before any publication.

Centre for Cybersecurity Belgium, the national CSIRT.

How to report a vulnerability

Send your report by e-mail to security@apb.be, in French, Dutch or English. If possible, encrypt your message or avoid sending sensitive information in clear text. Reports that do not concern a security vulnerability (e.g. privacy or regulatory compliance questions) will not be processed through this address.

Your report should preferably include:

  • the system, URL or service concerned;
  • the type of vulnerability and a description of its potential impact;
  • the steps to reproduce the vulnerability (proof of concept, screenshots);
  • the date of discovery;
  • your contact details, if you wish to be contacted. Anonymous reports are accepted.
Our commitments
Step APB commitment   Timeframe
Acknowledgement We confirm receipt of your report.   5 working days
Assessment We verify the vulnerability and inform you of our assessment and the next steps.   30 workings days
Remediation We fix the vulnerability within a timeframe proportionate to its severity and keep you informed of progress.   Depending on severity
Closure We inform you of the fix and agree with you on any publication.   Upon remediation
  • We treat your report confidentially and do not share your personal data without your consent, except where required by law or when forwarded to the CCB under the legal procedure.
  • If you comply with the rules of this policy, APB will not take civil or criminal action against you in connection with your research.
  • If the vulnerability concerns a supplier’s product or service, we may pass on the information needed to fix it.

Rules to follow

To benefit from this policy, you agree to:

  • act without fraudulent or malicious intent and without seeking any advantage;
  • not go beyond what is necessary and proportionate to demonstrate the existence of the vulnerability;
  • report the vulnerability to APB as soon as possible after its discovery;
  • not access, copy, modify or delete more data than necessary; if you access personal or confidential data, stop immediately, do not retain the data and inform us;
  • not disclose the vulnerability to third parties or publicly without APB’s consent as long as it has not been fixed;
  • comply with applicable law, in particular data protection legislation.

Prohibited actions

  • denial-of-service attacks or tests likely to degrade the availability of services;
  • social engineering (phishing, phone calls) targeting APB staff, members, clients or partners;
  • intrusion or attempted physical access to APB premises;
  • installing malware or backdoors, or maintaining persistent access;
  • using other users’ accounts or exploiting the vulnerability beyond the proof of concept;
  • any request for payment in exchange for the information (extortion).

Belgian legal framework

The NIS2 Law (articles 22 and 23) allows any person acting without fraudulent intent or intent to cause harm to report a vulnerability to the CCB and, subject to conditions, to benefit from legal protection. These conditions include in particular limiting actions to what is necessary and proportionate, reporting to the organisation concerned and to the CCB, and not disclosing the vulnerability publicly without consent.

In addition to your report to APB, you may therefore use the CCB’s legal reporting procedure (ccb.belgium.be), in particular if you do not receive a response from us within the stated timeframes.


Reward

APB does not operate a reward programme (bug bounty). No payment is due for a report.