Coordinated Vulnerability Disclosure Policy

Cropr B.V.  · Referenced by security.txt

1. Our commitment

Cropr B.V. takes the security of its products seriously. We welcome reports from security researchers and users who identify potential vulnerabilities in our products and services, and we are committed to investigating and resolving them. This policy explains how to report a vulnerability to us, what you can expect from us, and the conditions under which we treat your research as authorized.

2. Scope

In scope:

• Products with digital elements made by Cropr — the Cropr laser weeding machine — an autonomous agricultural machine that identifies and destroys weeds with lasers — its firmware, and the connected services and cloud backend that support it.
• Cropr-operated domains and endpoints — the websites and application programming interfaces (APIs) used by those products. These include cropr.ai and its subdomains.
• Products already in the field — this policy covers every supported model and firmware version, including units placed on the market before the Cyber Resilience Act applied.
• Third-party components we ship — where a component inside one of our products or services is affected, we want to hear about it, even though we are not its manufacturer. We will pass the report upstream as well as fixing our own products, and we will tell you when we have done so.

Out of scope:

• Third-party services and platforms Cropr does not operate.
• Findings without a realistic security impact (e.g. missing best-practice headers with no demonstrable exploit, theoretical issues).
• Volumetric denial-of-service, physical attacks, and social engineering of Cropr staff, customers or suppliers.
• Reports generated solely by automated scanners without validation.
• Products placed on the market by other legal entities, including H2L Robotics B.V. Those are covered by the security contact that entity publishes. If you are not sure which entity made the product you are looking at, write to us anyway and we will route your report — you will not lose your place in the queue.

3. How to report

Email security@cropr.ai (see our security.txt). For sensitive details, encrypt your report with our OpenPGP public key, published at the Encryption URL listed in our security.txt.

Please include where you can:

• The affected product, service, and version or firmware level.
• A clear description of the issue and its potential impact.
• Step-by-step reproduction instructions or a proof-of-concept.
• How you would like to be credited, or whether you prefer to remain anonymous.

We can correspond in English or Dutch.

If you would rather not report to us directly, you can report through the coordinated vulnerability disclosure process of the Dutch National Cyber Security Centre (NCSC-NL), which will contact us on your behalf.

Cropr does not operate a bug bounty program and does not offer monetary rewards for vulnerability reports. We recognize researchers through public credit, with your consent.

4. Safe harbor for good-faith research

If you make a good-faith effort to comply with this policy during your research, Cropr will consider your activity authorized, will not pursue or support legal action against you, and will work with you to understand and resolve the issue quickly. If legal action is initiated by a third party against you for activity conducted under this policy, we will make this authorization known.

This protection applies only while you stay within the guidelines in Section 5. Testing that goes beyond what is needed to confirm a finding — extracting other people’s data, disrupting a machine in the field, or interfering with equipment you do not own — is outside this policy and outside the authorization it gives.

Never test on a machine in operation. These are autonomous machines that emit laser radiation in working fields. Do not attempt any test that could affect the behaviour, motion or laser control of a deployed unit. If you believe you have found something that affects machine safety, stop, do not attempt to confirm it further, and contact us immediately — we will arrange a safe way to reproduce it.

5. Guidelines for researchers

• Act in good faith and avoid privacy violations, data destruction, and disruption of our services.
• Access only the minimum data needed to demonstrate the issue; do not download, retain, or share others’ data.
• Do not exploit the vulnerability beyond what is necessary to confirm it.
• Give us a reasonable opportunity to remediate before disclosing publicly and coordinate the timing of any disclosure with us.
• Do not use the finding for any purpose other than reporting it to Cropr.

6. What you can expect from us

• Acknowledgment — we triage every report on the day it reaches security@cropr.ai, including weekends, and we aim to confirm receipt to you within 3 business days. The internal clock starts when your email arrives, not when we reply.
• Validation & updates — we will triage and validate the report and keep you informed of progress.
• Remediation — we prioritize by severity and aim to have a fix or mitigation available within 30 days for critical findings and 90 days for others. Where a fix will take longer, we will tell you why and agree a revised date with you.
• Coordinated disclosure — we will agree the timing of any public disclosure with you; our default coordination window is 90 days from acknowledgment, which we can adjust by mutual agreement.
• Credit — with your consent, we will credit you for the discovery; we will respect a request to remain anonymous.
• Notice if we have to report — if your finding triggers a regulatory notification (see Section 7), we will tell you that we have filed one. Filing does not end our coordinated disclosure with you and does not make the finding public.

7. Relationship with regulatory reporting

Separately from this policy, the European Union Cyber Resilience Act (CRA) requires Cropr to notify the authorities — the National Cyber Security Centre of the Netherlands (NCSC-NL) as designated coordinator, and the European Union Agency for Cybersecurity (ENISA) — of actively exploited vulnerabilities and severe incidents. Four things follow, and none of them changes how we treat you.

• Reporting to us in good faith does not, by itself, make your finding reportable. A vulnerability is “actively exploited” under the CRA only where there is reliable evidence that a malicious actor has exploited it in a system without the system owner’s permission. Good-faith testing and research carried out under this policy is not that, and a proof-of-concept is not that.
• If evidence of real-world exploitation does emerge, we have 24 hours. At that point we must file an early warning, and the deadline runs from the moment we have reasonable certainty — not from the end of any disclosure window we have agreed with you. We may therefore have to notify the authorities while our coordinated disclosure with you is still running. We will tell you when that happens.
• A notification is not a publication. Reports go to the CSIRT and ENISA under strict handling rules, not to the public. Where a notification is required we will not include your personal details unless it is necessary and lawful to do so, and we will ask you first wherever we can.
• We may notify voluntarily. Article 15 CRA allows a manufacturer to notify a vulnerability that is not reportable. Where we judge that useful — for example where a component we ship is being exploited elsewhere — we may do so, and the same confidentiality applies.

8. Policy details

Owner	Inbound contact / Coordinated Vulnerability Disclosure owner, Cropr B.V. — security@cropr.ai
Languages	English, Dutch
Version	1.1 · Last updated 1 September 2026
Review	At least annually, and after any material process change
Related document	CRA Incident & Vulnerability Reporting Handbook (CRA-HB-01), which governs how Cropr assesses and reports under Article 14 CRA
Scope of this policy	Products and services placed on the market by Cropr B.V. Other group entities publish their own security contact.