Hall Of Fame

Here is the list of the individuals and organizations that explicitly helped us in improving the security of the EU Institutions, Agencies, and Bodies by reporting security issues and vulnerabilities discovered. Anybody interested in reporting, should read the CERT-EU Responsible Disclosure Policy first.

---

---

CERT-EU Responsible Disclosure Policy

What to report to CERT-EU:

Security Incidents and Vulnerabilities, which occur in software components, protocols, or hardware of websites or systems of EU Institutions Agencies or Bodies, and may affect significant number of users and/or critical infrastructure.

Vulnerability reporting policy:

CERT-EU reserves the right to accept or reject any vulnerability disclosure report at its discretion, based on the following general criteria:

1. Pre-disclosure handling of the potentially sensitive vulnerability details:
   • The vulnerability should have not already been publicly disclosed.
   • It is important to report the vulnerability as quickly as possible after its discovery.
   • Even after reporting the vulnerability, no information on the security problem should be shared with others until the incident has been processed and resolved. Failure to comply with this requirement may result in the reported being removed from the CERT-EU Hall of Fame.
2. The vulnerability finding must be new and severe enough to be considered as eligible for a mention in the Hall of Fame of CERT-EU. The severity of a vulnerability finding is assessed by CERT-EU at its own discretion. CERT-EU reserves the right to reject reports of vulnerabilities, which have already been previously reported.

Vulnerability reporting instructions:

• E-mail your findings to reports (at) cert.europa.eu.
• Encrypt your email using the PGP key available on CERT-EU website
• Provide as much information as possible regarding the finding, in order for CERT-EU to handle the incident as efficiently as possible.

If more information is required, CERT-EU will contact the reporter, therefore any contact details (email address and telephone number) should be valid.

If the previously mentioned conditions are satisfied, CERT-EU will proceed with notification to the impacted party. Once the issue has been fixed or no later than 3 months since the initial report, the reporter may be mentioned (at his own discretion) in the Hall of Fame of CERT-EU (this page) with a short description of the type of vulnerability reported.