At Mijndokters Technologies, the security of our systems and data is a top priority.
Despite our best efforts, vulnerabilities may still exist. We appreciate your help in identifying and responsibly reporting any security issues so we can address them quickly and safely.

We commit to treating every report with respect, confidentiality, and fairness.

Security scope
Our internal security responsibilities cover all systems and services operated by Mijndokters Technologies. Not all of these systems are in scope for public testing or rewards.

In-scope for public testing and rewards
Our responsible disclosure / reward program focuses on:

• Public, customer-facing production systems operated by Mijndokters Technologies

• Systems under domains we control that process or expose customer or patient data

Out of scope for public testing and rewards
The following are not eligible for testing or rewards under this policy and are protected through our internal security processes instead:

• Development, test, and staging environments

• Internal CI/CD and build systems (e.g. Drone, build pipelines)

• Third-party systems not owned or managed by us (e.g., hosting providers, analytics tools, payment processors)

• Denial-of-service (DoS/DDoS) testing, load testing, or brute-force attacks

• Social engineering (e.g., phishing employees, support desk manipulation)

• Physical attacks against our offices, data centers, or equipment

If you are unsure whether a target is in scope, please contact us before conducting tests.