Report a vulnerability

Have you found a security vulnerability in our website or our services? Thank you for letting us know. This page lists every way to reach us, encrypted or anonymously.

All contacts at a glance below. How we handle reports is set out in our coordinated vulnerability disclosure policy.

How to reach us

Products and services (PSIRT)

Vulnerabilities in the software and services of CRA Response Center.

psirt@cra-response-center.de

OpenPGP key: psirt.asc
Fingerprint:
3920 2416 872C 3ADE 73A9 EACC 3EEF 5D21 63A8 B393

Website and infrastructure (CSIRT)

Vulnerabilities in this website, its forms and servers.

csirt@cra-response-center.de

OpenPGP key: csirt.asc
Fingerprint:
D82B 2661 BA06 B29D 7F56 71A2 F476 2447 105E 11D0

Please send confidential information encrypted and signed. Not sure where your report belongs? Write to psirt@ and we will forward it internally. The address security@cra-response-center.de reaches the same team. We reply in English and German.

Our security.txt is signed with a separate key: security-txt-signatur.asc, fingerprint AB06 1AFE 2534 E9E0 32B2 FB08 5588 EAF3 22A5 647E.

Report form

You can also report without giving a name or contact details. Without contact details, however, we cannot ask follow-up questions, so we can process anonymous reports only to a limited extent or possibly not at all.

What happens next

Within 5 working days, a person replies to you. We do not send automated acknowledgements.
Within 10 working days you receive detailed feedback: confirmation or rejection, follow-up questions, or an explanation of why it is taking longer.
We do not require a non-disclosure agreement and will not file a criminal complaint against you, as long as you follow our policy.
We publish confirmed vulnerabilities within 90 days and agree the timing with you.

Enquiries about the status of your report are welcome at any time.

Acknowledgements

Here we thank everyone who has reported a valid vulnerability to us and wishes to be named. There are no entries yet.

At a glance

All ways to reach us in one list:

Products and services (PSIRT): psirt@cra-response-center.de, OpenPGP key psirt.asc, fingerprint 3920 2416 872C 3ADE 73A9 EACC 3EEF 5D21 63A8 B393
Website and infrastructure (CSIRT): csirt@cra-response-center.de, OpenPGP key csirt.asc, fingerprint D82B 2661 BA06 B29D 7F56 71A2 F476 2447 105E 11D0
Web form, anonymous if you wish: report form above.
security.txt signing key: security-txt-signatur.asc, fingerprint AB06 1AFE 2534 E9E0 32B2 FB08 5588 EAF3 22A5 647E

Response times and our commitments to reporters are set out above and in our coordinated vulnerability disclosure policy.