VIARIS

Responsible Disclosure

How to report a security vulnerability to Viaris / RAENBI GROUP BV: channel, PGP fingerprint, scope, coordinated timeline and the Belgian CVD framework.

Last reviewed
11 October 2026

In brief

  • Report a vulnerability in one structured email to security@autovig.eu with "security report" in the subject; the in-scope surface is viaris.eu, its build output and the cookie-consent flow.
  • Use the published PGP fingerprint and public key; Autovig and Viaris share one controller CVD channel.
  • Good-faith research within scope is authorised by the controller; the statutory exemption in article 23 of the Belgian NIS2 law also requires notifying the CCB (CERT.be) within 24 and 72 hours.

RAENBI GROUP BV (brands Viaris and Autovig) welcomes good-faith security research on its public properties. This policy is the controller’s coordinated-vulnerability-disclosure (CVD) policy. It applies to viaris.eu and is aligned with the Autovig CVD channel of the same controller.

1. Reporting channel

If you cannot reach us, or if you do not receive an acknowledgement within the timeline below, you may refer the report to:

Reports are welcome in English, French, German, Dutch, Romanian or Polish.

2. Scope

In scope:

  • viaris.eu and any subdomain serving production content;
  • the static-site build output: HTML, CSS, JS bundles and structured data we emit;
  • the cookie-consent flow and on-device consent storage.

Out of scope:

  • third-party operator websites — report to those operators directly;
  • issues that require a compromised browser, malicious extension or physical device access;
  • automated-scanner output without a clear, demonstrable security impact;
  • reports about missing best practices where no exploitable risk is shown.

3. What to include

A useful report includes: a clear description, affected URL(s), steps to reproduce, impact assessment, and any proof-of-concept limited to what is needed to demonstrate the issue.

4. Our commitments

  • Acknowledge within 5 business days.
  • Triage severity within 10 business days.
  • Target remediation or mitigation within 90 days under coordinated disclosure, unless complexity requires a longer window that we communicate to you.
  • There is no paid bug bounty; we may offer public credit if you wish.

5. Safe harbour and Belgian legal framework

Good-faith research that stays within this policy’s scope and avoids privacy harm, service disruption and data exfiltration beyond what is needed to demonstrate the issue is treated as authorised by us, as controller of the in-scope assets. This authorisation does not bind public authorities or third parties.

Separately, article 23 of the Belgian Loi du 26 avril 2024 (the Belgian NIS2 law) exempts people who report a potential vulnerability under its article 22 from certain offences, including unauthorised access to an IT system, if they meet all of its conditions — among them a simplified notification to us and to the CCB within 24 hours of discovery, a complete notification within 72 hours, proportionate actions only, and no public disclosure without the CCB’s agreement. The CCB’s CVD page is the reference: https://ccb.belgium.be/regulation/cvdp.

6. Privacy of reports

Report data is processed under GDPR art. 6(1)(f) for coordinated disclosure. Details are in the Privacy Policy. Closed reports are retained for up to 5 years.

Sources

Related legal pages