- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 16
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report as the policy says
- The policy page explains how.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 3 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 3 days
We will do our best to contact you about your report within three working days.
- Safe harbor
-
Partial
It is possible that you break laws and regulations when investigating your finding. We will not file a police report if you act in good faith and work cautiously in the way we ask from you.
- Hall of fame
-
Yes
Part of our reward program is a registration in our hall of fame:
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
16 assets you may test, 5 excluded.
Domains 1
- achmea.nl
Products and areas 15
- Achmea
- Achmea Australia
- Avéro Achmea
- Centraal Beheer
- De Christelijke Zorgverzekeraar
- De Friesland Zorgverzekeraar
- Eureko Sigorta
- Eurocross
- FBTO
- Hagelunie
- InShared
- Interamerican
- Interpolis
- Union
- Zilveren Kruis
Out of scope (5)
- complaints
- fake (phishing) email messages
- fraud
- incorrectly functioning sites or services
- unavailable sites or services
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Achmea's policy. "We" in these lines means the program, not this site.
While testing
-
We ask that you do not publish your finding, and that you only share it with Achmea’s experts.
-
You are not allowed to damage our systems or services.
-
our services must not be interrupted intentionally by your investigation.
-
only contact Achmea about your finding, through the communication channels noted in this responsible disclosure procedure.
-
report one finding in each report.
-
only do what is strictly necessary to show the existence of the vulnerability.
-
refrain from applying social engineering.
-
refrain from using generic vulnerability scanning.
-
do not install backdoors, for whatever reason (e.g. to show how a vulnerability works).
-
do not to copy, change or remove data from our systems.
Not accepted
-
HTTP 404 codes and other non-HTTP 200 codes
-
Run-on type inserted 404 paged.
-
Version banners on public services
-
Files and folders with non-sensitive information accessible tot he public
-
Clickjacking on pages without login functionality
-
Cross-site request forgery (CSRF) on forms accessible anonymously
-
A lack of ‘secure’ or ‘HTTP Only’ flags on non-sensitive cookies
-
Use of HTTP OPTIONS method.
-
Host header injection
-
Absence of SPF, DKIM and DMARC records
-
Absence of DNSSEC
-
Absence or incorrectly applied HTTP security headers, including but not limited to:
-
Strict-Transport-Security (HSTS)
-
HTTP Public Key Pinning (HPKP)
-
Content-Security-Policy (CSP)
-
X-Content-Type-Options
-
X-Frame-Options
-
X-WebKit-CSP
-
X-XSS-Protection
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.