generated: '2026-09-19'
method: searched
probe: true
source: well-known/co-legal-be-security.txt
docs:
- https://co-legal.be/security
policy:
- https://co-legal.be/security.html
- https://co-legal.be/security
contact:
- mailto:contact@co-legal.be
preferred_languages: [nl, en]
expires: '2027-05-19T00:00:00.000Z'
canonical: https://co-legal.be/.well-known/security.txt
bug_bounty: false
evidence:
- source: well-known/co-legal-be-security.txt
  kind: security.txt (RFC 9116, fetched 2026-09-19 from https://co-legal.be/.well-known/security.txt, 200 text/plain)
  quote: "# We don't run a paid bug-bounty programme today, but we credit valid reports and respond fast. Contact: mailto:contact@co-legal.be / Expires: 2027-05-19T00:00:00.000Z / Preferred-Languages: nl, en / Canonical: https://co-legal.be/.well-known/security.txt / Policy: https://co-legal.be/security.html"
- source: https://co-legal.be/security.html
  http_status: 301
  redirect: https://co-legal.be/security
  note: The Policy URL in security.txt 301s to the extensionless page, which is live (200, text/html, 28,634 bytes).
- source: https://co-legal.be/security
  http_status: 200
  kind: security & data page
  quote: 'Security-melding, vulnerability-disclosure, vraag over deze pagina: contact@co-legal.be met "[SECURITY]" in het onderwerp. Onze RFC 9116 security.txt bevat dezelfde gegevens machine-leesbaar.'
  keywords: [vulnerability-disclosure, security-melding, security.txt, incident response]
note: >-
  A real, complete RFC 9116 file with a Policy page that resolves, a named contact, a one-year Expires, a
  Canonical self-reference and language preferences. The disclosure channel is e-mail with a "[SECURITY]"
  subject tag; there is no HackerOne/Bugcrowd/Intigriti programme and the file says so. The policy page also
  publishes the incident-response timeline (triage 0–4 h, partner notification 4–24 h, regulator assessment
  within 72 h, post-mortem within 14 days). Security pointer emitted at https://co-legal.be/security.