Get API keyGet key
Last updated · October 20, 2026

Vulnerability Disclosure Policy

This policy sets out how to report vulnerabilities in Beliq to us, which testing is allowed for that, and what we commit to in return. It is our policy on coordinated vulnerability disclosure within the meaning of Annex I Part II point 5 of Regulation (EU) 2024/2847 (Cyber Resilience Act). It is a declaration by the provider named in the imprint and does not form part of any contract. This is a translation of the German Richtlinie zur Meldung von Schwachstellen, which is the original and the binding version (see Section 8).

1. Scope

This policy covers

  • the website beliq.eu,
  • the API at api.beliq.eu,
  • the dashboard at dashboard.beliq.eu,
  • the documentation at docs.beliq.eu,
  • the software we publish in the beliq-eu GitHub account and on npm and PyPI, such as our SDKs, the command-line tool, the MCP server and the integrations.

It does not cover

  • third-party services we use, for example for hosting, email or payments. Please report vulnerabilities there to the provider concerned,
  • networks and access points for the transmission of invoices, such as Peppol, which we do not operate.

2. How to report a vulnerability

Write to the address named in our security.txt, in English or German. It helps to include

  • the affected part: URL, API endpoint, or package and version,
  • the steps that reproduce the vulnerability,
  • what an attacker could achieve with it,
  • a way to reach you with questions.

We handle the output of automated scans without an explanatory description only to a limited extent. You may report anonymously. We then cannot ask you questions, and the report may not be fully actionable.

3. Rules for testing

You may look for vulnerabilities provided you follow all of these rules. You

  • test only with your own accounts, your own API keys and your own data, or with your own installation of our software,
  • do not access other customers' data. If you come across someone else's data anyway, you stop the test, do not store, copy or change anything, and report it to us,
  • do no more than is needed to demonstrate the vulnerability. In particular, you do not change or delete data and do not set up persistent access,
  • do not impair any of our services for others, in particular not through overload or mass automated scanning, and keep to the API rate limits that apply to your access,
  • do not deceive people, send spam, guess passwords or carry out physical attacks,
  • do not exploit a vulnerability for your own benefit or to the detriment of others, and pass on neither the vulnerability nor tools to exploit it to third parties,
  • do not publish the vulnerability until we have agreed on the timing (Section 4). If we do not reply or no agreement is reached, you agree the timing with the BSI,
  • once finished, delete the data you obtained during the test, except what you need for the report.

If you follow these rules, this policy is our prior consent in text form to security testing under Section 5 of the Acceptable Use Policy. Testing beyond these rules still needs our consent case by case. Ask for it in advance at the address in the security.txt.

4. What we commit to

  • We confirm receipt of your report and tell you how we assess it.
  • We keep you informed about the fix.
  • We treat your report as confidential and do not pass your personal data to third parties without your express consent, unless the law requires us to.
  • We agree the timing of any publication with you.
  • We announce fixes in our published software as a security advisory in the affected GitHub repository. If you wish, we credit you there by name or pseudonym.

We commit to no fixed deadline for a reply or a fix. Beliq is a small business, and we commit only to what we can keep. If you get no reply, or no agreement on the timing of publication is reached, you can turn to the German Federal Office for Information Security (BSI), which mediates between reporters and manufacturers.

If a vulnerability in one of our published packages is being actively exploited, we notify the competent CSIRT and ENISA under Article 14 of Regulation (EU) 2024/2847.

5. Our assurance

If you follow this policy and act in good faith, we will not file a criminal complaint or request prosecution against you because of your testing or your report, and we will not bring civil claims against you. This does not apply where criminal intent was or is evidently being pursued.

This assurance binds only us. We cannot rule out claims by third parties, such as our service providers, or action by public authorities. If you are unsure whether a test is covered by this policy, please ask first.

6. No rewards

We pay no rewards for reports.

7. Changes to this policy

We may change this policy. A test is governed by the version published when it began. The date of the version is shown on this page as "Last updated"; we send earlier versions on request.

8. Language version

This policy was drafted in German. This English version is for information only; in the event of discrepancies the German version prevails.

9. Contact

Send reports and questions about this policy to the address named in our security.txt.