We will confirm receipt of your report within one week. If we need additional information, we will contact you.
Our PSIRT determines whether the report falls within our jurisdiction and whether a potential vulnerability exists.
In doing so, we take the following into account in particular:
To the extent possible, we attempt to technically understand and reproduce the reported vulnerability. Internal development teams and other relevant departments may be involved in this process.
Confirmed vulnerabilities are assessed according to established criteria. Among other methods, the Common Vulnerability Scoring System (CVSS) may be used for this purpose. The final assessment may differ from the reporter's initial assessment.
Depending on the identified risk and the product architecture, we determine appropriate measures. These may include, for example:
If you have provided us with your contact information, we will notify you of the results of our evaluation.
We work with whistleblowers based on the principle of coordinated disclosure. The goal is to protect affected customers and operators while ensuring transparent communication.
We ask that you refrain from disclosing information about the vulnerability until the assessment is complete and, if necessary, appropriate measures or customer information are available.
If necessary, a CVE identifier can be requested for a confirmed vulnerability. Depending on the assessment and potential impact, the vulnerability may be classified as Safety Notice be published on our website.
German German 
English
French
Norwegian
Chinese
