Report a Vulnerability

1. Our Coordinated Vulnerability Disclosure Policy

We take vulnerability reports seriously and work with everyone who informs us responsibly. Our approach follows the principles of coordinated vulnerability disclosure as described in ISO/IEC 29147: you report the vulnerability to us confidentially, we investigate and fix it, and only then is it made public – coordinated with you if you wish.

2. Scope

This policy applies to the websites and online services of Rootsektor IT-Security GmbH, in particular www.rootsektor.de with all its pages and forms.

It does not cover systems of our clients and partners or third-party services that we merely use – such as our web hosting, Microsoft 365, or Google. Please report vulnerabilities in such systems directly to the respective operator.

As a rule, we do not consider reports without a demonstrable security impact to be vulnerabilities under this policy – for example, mere version information, missing best-practice settings without a concrete attack scenario, or automated scanner output without proof.

3. How to Report a Vulnerability

Use the form at the end of this page or email security@rootsektor.de – in English or German. If you would like to send your report encrypted, we will be happy to agree on a method with you. The following information is particularly helpful:

• the affected URL or system,
• a description of the vulnerability and its type, for example cross-site scripting or a misconfiguration,
• the steps to reproduce the vulnerability, including a proof of concept where applicable,
• your assessment of the potential impact,
• your contact details for follow-up questions – anonymous reports are possible but make follow-up more difficult.

You will find machine-readable contact details in accordance with RFC 9116 in our security.txt.

4. Ground Rules

To ensure your testing does not harm anyone, please follow these rules:

• No attacks that affect availability, in particular no denial-of-service tests.
• No automated mass scans and no brute-force attacks on logins.
• Access only as much data as is strictly necessary to demonstrate the vulnerability. Do not modify or delete data, and do not download third-party data.
• No social engineering against our employees, clients, or partners, and no attempts to gain physical access.
• Do not exploit a vulnerability beyond what is necessary to demonstrate it, and do not install backdoors.
• Keep your findings confidential until the vulnerability has been fixed and we have agreed on publication together.

5. What Happens After You Report

1. Acknowledgment: We usually confirm receipt of your report within a few business days.
2. Investigation and assessment: We reproduce the vulnerability, assess its severity, and contact you if we have questions.
3. Remediation: We fix confirmed vulnerabilities as quickly as their risk requires and keep you informed of our progress.
4. Coordinated disclosure: We agree with you on whether and when details are published – as a rule, only after the vulnerability has been fixed.

6. Our Commitments

If you comply with this policy, we commit to the following:

• We treat your report and your data confidentially and will not share your contact details with third parties without your consent.
• We will refrain from taking legal action against you if you have acted in good faith and in accordance with this policy (safe harbor). This commitment applies to Rootsektor IT-Security GmbH; it cannot exclude the rights of third parties, such as service providers or authorities.
• If you wish, we will credit you by name as the finder of the vulnerability once it has been fixed.

7. No Bug Bounty

We do not operate a bug bounty program and do not pay rewards for reports. We are happy to credit you by name if you wish.

8. Privacy

Your report reaches us by email at security@rootsektor.de. We use your information solely to process your report and for follow-up questions. For details, please see our Privacy Policy.