Responsible disclosure policy

Coordinated vulnerability disclosure

Valtech Group and its companies take the security of our machines, software, services and websites seriously. If you believe you have found a security vulnerability, we want to hear about it. We welcome reports from security researchers, customers, partners and anyone else, and we will work with you to resolve the issue.

Scope

This policy covers:

  • Websites, portals and online services of Valtech Group and its companies (listed at our group), including valtechgroup.eu and the companies’ own domains.
  • Machines, installations, control software, HMIs, vision systems and remote-service connections that we supply.
  • Third-party or open-source components in our products or systems, where a vulnerability could affect our customers or operations.

Out of scope

The following are not covered by this policy:

  • Reports from automated scanners without a demonstrated, exploitable impact.
  • Missing security headers, cookie flags or SPF/DKIM/DMARC settings without a demonstrated impact.
  • Clickjacking on pages without sensitive actions, self-XSS, and missing rate limits on non-sensitive functions.
  • Vulnerabilities in third-party services we use but do not manage. Please report these to the vendor.
  • Physical attacks and testing on machines installed at customer sites. If you notice a vulnerability in one of our machines, please report it to us without testing it on site.

How to report

Send your report to security@valtechgroup.eu. If your report contains sensitive information, email us first without the details and we will arrange a secure way to share them.

Please include:

  • A description of the vulnerability and its possible impact.
  • The affected website, URL, system, product, model or software version.
  • Step-by-step instructions to reproduce it.
  • Supporting evidence such as screenshots, logs or a proof of concept.
  • How we can reach you, if you would like us to follow up.

You may report in English, Dutch or French.

What you can expect from us

  • Acknowledgement: we confirm receipt within a reasonable time.
  • Assessment: we tell you within a reasonable time whether we have confirmed the vulnerability and how we plan to address it.
  • Updates: we keep you informed of significant progress until the issue is resolved.
  • Confidentiality: we handle your report confidentially. We do not share your personal details outside our organisation without your permission, unless we are legally required to.
  • Remediation: we fix confirmed vulnerabilities as quickly as their severity requires.
  • Disclosure: we agree with you when and how the vulnerability is made public. We aim to do this within 90 days of your report.

Rules for researchers

We ask you to:

  • Act in good faith, and do no more than is needed to demonstrate the vulnerability.
  • Not access, copy, change or delete data that is not yours. If you come across personal or confidential data, stop, report it, and delete any copies.
  • Not use denial-of-service attacks, phishing, social engineering, malware or brute-force attacks.
  • Not disrupt our services, production systems or customer installations.
  • Not share the vulnerability with others until we have resolved it and agreed on disclosure, or until 90 days after your report, unless we agree otherwise.

Safe harbour

If you report a vulnerability in good faith and follow this policy, Valtech Group and its companies will not take legal action against you or ask authorities to do so. We consider research on our own systems that follows this policy to be authorised. Please note that we can only make this commitment on our own behalf, not for our customers or other third parties.

If you are unsure whether your planned research falls within this policy, please contact us first.

Product security

For vulnerabilities in our machines and software, we inform affected customers and, where required, the competent authorities. Where appropriate, we also publish a security advisory.

Recognition

We do not offer a financial bug bounty. With your permission, we are happy to thank you publicly, for example in the related security advisory.

Contact

For questions about this policy: security@valtechgroup.eu

Valtech NV, Krommebeekstraat 41, 8930 Menen, Belgium, VAT BE 0466.148.445

Last updated: 28 October 2026