1. Purpose of this policy
secnostic welcomes responsible reports about vulnerabilities in our public website and software. This policy explains what may be tested, how to report a finding, and how we handle coordinated disclosure.
It does not authorize testing outside the expressly stated scope and does not replace written permission for customer or third-party systems.
2. Report a vulnerability
Send reports primarily to security@secnostic.com. For a time-critical finding, you may also call our office at +49 6471 3199929.
A useful report includes, where possible:
- the affected product, version, URL, endpoint, and environment;
- a description of the vulnerability, prerequisites, and likely impact;
- exact, minimal reproduction steps and a small proof of concept;
- sanitized screenshots or logs, timestamps, and available request IDs;
- a suggested remediation, if available, plus your contact details and disclosure plans.
Do not send unnecessary credentials, secrets, or third-party personal data. For sensitive attachments, first describe what you hold and agree on an appropriate transfer method with us.
3. Scope
The commitments in this policy apply to these clearly bounded systems:
- https://www.secnostic.com, including the public web application served there;
- secnostic software in accounts or environments you own, or for which you have express written authorization to test.
Reports about other systems controlled by secnostic are welcome. Ask before testing when scope is unclear. Customer, partner, cloud-provider, hosting-provider, and other third-party systems are excluded.
4. Good-faith research rules
Test minimally, in a controlled way, and without avoidable effects on availability or data.
- Stop once you have enough evidence to demonstrate the issue.
- Use only accounts, systems, and data that you own or are expressly authorized to use.
- Stop if you encounter sensitive or third-party data. Do not retain, copy, alter, delete, or disclose it.
- Respect rate limits and avoid excessive automated traffic.
- Do not perform DoS/DDoS, resource exhaustion, brute force, password spraying, social engineering, phishing, spam, physical attacks, malware, persistence, lateral movement, or supply-chain attacks.
- Scanner output without human validation, a reproducible impact, and useful documentation is not sufficient.
5. Safe harbor for good-faith research
If you act in good faith, remain within the stated scope, and follow these rules, secnostic will treat that research as authorized and will not initiate civil or criminal action because of that research. This commitment does not bind third parties or authorities and does not cover conduct outside this policy.
If you are unsure whether a planned action is covered, contact security@secnostic.com first and wait for written authorization.
6. What you can expect from us
We target an acknowledgment within three business days. We then validate and prioritize the finding based on impact, exploitability, and the affected environment.
- We provide updates when there are material findings or remediation milestones.
- We handle the report and the reporter's identity confidentially.
- Public credit is given only with your explicit consent.
- Remediation time depends on risk, product dependencies, and safe rollout.
7. Coordinated disclosure, recognition, and compensation
Keep technical details confidential until a fix or dependable mitigation is available, and agree with us on a reasonable publication date. We will not request an indefinite embargo.
This is not a public bug-bounty program, and reports do not create an entitlement to payment. secnostic may offer voluntary recognition or compensation case by case only after written agreement.
8. Contact, standards, and updates
Security-contact discovery follows RFC 9116 for security.txt. Our disclosure process also draws on the BSI guidance for handling IT vulnerabilities.
secnostic GmbHSiemensstraße 10D-35799 MerenbergDeutschland- Security contact
- security@secnostic.com
- Phone
- +49 6471 3199929
- security.txt
- /.well-known/security.txt
Last updated: . Last reviewed: . If translations differ, the German policy controls.