Water-Link VDP
By Water-link Vulnerability disclosure program on Intigriti water-link.be
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on Intigriti
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 14 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What Intigriti lists as the payout for each severity.
This program does not pay cash rewards.
- Pays cash
-
No
Please note that we will not be paying bounties for this VDP - if a bounty is what you're after, our public program is for you!
- Response
-
Within 14 days
We aim to respond to report in ultimately two weeks, probably faster!
- Safe harbor
-
Full
We respect the safe harbour clause that you can find below
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test.
Wildcard domains 2
- *.aww.be
- *.water-link.be
Web 1
- water-link-jaarverslag.be
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Water-Link VDP (via Intigriti)'s policy. "We" in these lines means the program, not this site.
While testing
-
Provide detailed but to-the point reproduction steps
-
Include a clear attack scenario. How will this affect us exactly?
-
Reports should be written in English
-
Remember: quality over quantity!
-
Please do *not* discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
-
Please do *not* use automatic scanners -be creative and do it yourself! We cannot accept any submissions found by using automatic scanners.
Not accepted
-
API key disclosure without proven business impact
-
Wordpress usernames disclosure
-
Pre-Auth Account takeover/OAuth squatting
-
Self-XSS that cannot be used to exploit other users
-
Verbose messages/files/directory listings without disclosing any sensitive information
-
CORS misconfiguration on non-sensitive endpoints
-
Missing cookie flags
-
Missing security headers
-
Cross-site Request Forgery with no or low impact
-
Presence of autocomplete attribute on web forms
-
Reverse tabnabbing
-
Bypassing rate-limits or the non-existence of rate-limits.
-
Best practices violations (password complexity, expiration, re-use, etc.)
-
Clickjacking without proven impact/unrealistic user interaction
-
CSV Injection
-
Sessions not being invalidated (logout, enabling 2FA, etc.)
-
Tokens leaked to third parties
-
Anything related to email spoofing, SPF, DMARC or DKIM
-
Content injection without being able to modify the HTML
-
Username/email enumeration
-
Email bombing
-
HTTP Request smuggling without any proven impact
-
Homograph attacks
-
XMLRPC enabled
-
Banner grabbing/Version disclosure
Summarised with AI from the program policy on Intigriti, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 17 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Reward raised
Maximum no amount → no amount
-
Scope added
water-link-jaarverslag.be
-
Scope removed
https://www.water-link-jaarverslag.be
-
Scope removed
https://www.waterstoring.be/
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from www.intigriti.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
At Water-link, we build with precision and defend with purpose—but we know the real edge comes from those who operate outside the perimeter. You spot the cracks before they become breaches. You think in payloads, not platitudes. And that’s exactly why your work matters. Your ability to uncover vulnerabilities and help us patch them doesn’t just harden our systems—it raises the bar for security across the entire web. You’re not just contributors; you’re catalysts. We see the time you invest, the skill you bring, and the mindset that drives it all. And we respect the hell out of it. Let’s keep pushing boundaries together. .
Please note that we will not be paying bounties for this VDP - if a bounty is what you're after, our public program is for you!
Stay curious. Stay dangerous (to bugs, that is) 😉
Rules of engagement
Our promise to you
- We aim to respond to report in ultimately two weeks, probably faster!
- We are happy to respond to any questions, please use the button in the right top corner for this.
- We respect the safe harbour clause that you can find below
Your promise to us
- Provide detailed but to-the point reproduction steps
- Include a clear attack scenario. How will this affect us exactly?
- Reports should be written in English
- Remember: quality over quantity!
- Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
- Please do not use automatic scanners -be creative and do it yourself! We cannot accept any submissions found by using automatic scanners. Scanners also won't improve your skills, and can cause a high server load (we'd like to put our time in thanking researchers rather than blocking their IP's 😉)
In scope
Hey there!
Found a security issue on our infrastructure that you'd like to report? It doesn't fit the scope of our public program, but at the same time is also not explicitly out of scope?
Please report it responsibly using our VDP :)
Any other relevant information concerning Threat Intel is welcome as well, such as data leaks containing information about water-link employees, impersonation or phishing attempts targeting water-link customers or information about planned campaigns against water-link.
Feedback Would you like to help us improve our program or have some feedback to share, please send your anonymous feedback here:
Program feedback link Please note this form will be checked periodically and should not be used for submission or support queries.
Out of scope
Same as for our public program:
Application:
- API key disclosure without proven business impact
- Wordpress usernames disclosure
- Pre-Auth Account takeover/OAuth squatting
- Self-XSS that cannot be used to exploit other users
- Verbose messages/files/directory listings without disclosing any sensitive information
- CORS misconfiguration on non-sensitive endpoints
- Missing cookie flags
- Missing security headers
- Cross-site Request Forgery with no or low impact
- Presence of autocomplete attribute on web forms
- Reverse tabnabbing
- Bypassing rate-limits or the non-existence of rate-limits.
- Best practices violations (password complexity, expiration, re-use, etc.)
- Clickjacking without proven impact/unrealistic user interaction
- CSV Injection
- Sessions not being invalidated (logout, enabling 2FA, etc.)
- Tokens leaked to third parties
- Anything related to email spoofing, SPF, DMARC or DKIM
- Content injection without being able to modify the HTML
- Username/email enumeration
- Email bombing
- HTTP Request smuggling without any proven impact
- Homograph attacks
- XMLRPC enabled
- Banner grabbing/Version disclosure
- Not stripping metadata of files
- Same-site scripting
- Subdomain takeover without taking over the subdomain
- Arbitrary file upload without proof of the existence of the uploaded file
- Blind SSRF without proven business impact (pingbacks are not sufficient)
- Disclosed/misconfigured Google Maps API keys
- Host header injection without proven business impact
Severity
This program follows Intigriti's triage standards based on the proof of concept.
FAQ
For https://aquawardsoperateacc.water-link.be
You can self register on the site, please use your intigriti.me account