We accept vulnerability reports by email only.

We handle all incoming vulnerability reports to the best of our knowledge and belief. No report is closed solely on the basis of one person's assessment.

A vulnerability is considered valid if it concerns a product with digital elements from QUNDIS GmbH.
 

3. Confidentiality and protection of reporters

We treat every vulnerability report as confidential to the extent permitted by law. This does not apply to information required for the coordinated disclosure of a vulnerability.

Personal data relating to a reporter will not be disclosed to third parties without the reporter's explicit consent, unless this is required in connection with an official investigation.

We will not initiate criminal proceedings against reporters provided that they comply with the requirements and principles of this procedure. This does not apply where criminal intent was or is evident.

We remain available for a confidential dialogue throughout the CVD process.

We expressly welcome reports of vulnerabilities, as they help us improve the security of our products. However, submitting a vulnerability report does not create any entitlement to a financial reward, bug bounty or other remuneration.

  
4. Information to include in your report.

To help us assess and investigate a reported vulnerability efficiently, please provide as much relevant information as possible. Where applicable, a complete report should include the following:

• Name of the affected QUNDIS GmbH product or component and its firmware or software version.
• A clear description of the suspected vulnerability, including its cause and the identified security impacts.
• Clear, detailed step-by-step instructions enabling the vulnerability to be reproduced and verified independently.
• A description of any specific configurations, operating conditions, permissions, authentication requirements or other prerequisites needed to reproduce the issue.
• A description of the possible consequences of successful exploitation. This includes the affected assets, data, systems or users, as well as the level of access an attacker could obtain.
• Where available: a proof of concept, test case, screenshots, log files or exploit code demonstrating the issue.
• Any additional technical details, indicators, logs or supporting evidence that may assist in validating and assessing the vulnerability.
   

5. Excluded matters

The following matters generally fall outside this coordinated vulnerability disclosure process:

• Vulnerabilities that have already been publicly disclosed, assigned a CVE number, or remedied through a security update or other mitigation. This does not apply if the report contains material new information, identifies previously unknown security impacts, or indicates that the remedy is incomplete or ineffective.
• Vulnerabilities in products, software, services or versions that have reached the end of their life cycle (end of life) or that we no longer support.
• Vulnerabilities in versions for which we have already recommended an upgrade or migration to a supported version and where the reported issue has been remedied in the recommended version.
• Findings without a relevant security impact. These include purely informational observations, general security recommendations or weaknesses that cannot reasonably be exploited in the affected environment.
• Matters primarily involving social engineering, phishing, spam or attacks on employees or customers of QUNDIS GmbH or other third parties, and which are not based on a vulnerability in a product or service of QUNDIS GmbH.
• Reports that have been generated exclusively by automated scanning tools and do not contain sufficient information to reproduce or validate the issue.
• Vulnerabilities in third-party products or services that we do not develop, maintain, distribute or operate. Such issues should be reported to the relevant manufacturer or service provider.