Coordinated vulnerability disclosure policy

CRA Response Center (provider: see legal notice). Version 1.0, created on 8 October 2026, next review by October 2027 at the latest. Summary below.

We thank everyone who reports vulnerabilities to us. This policy describes how to report a vulnerability to us, what you can expect from us and what we expect from you. It follows Technical Guideline BSI TR-03183-3 of the German Federal Office for Information Security (BSI), section 4.4.

1. Scope

This policy applies to the software and services of CRA Response Center and to the website cra-response-center.de with its forms, tools and servers. It does not cover systems of service providers we use; we pass on reports about them.

2. How to report a vulnerability

• Products and services (PSIRT): psirt@cra-response-center.de, OpenPGP key psirt.asc, fingerprint 3920 2416 872C 3ADE 73A9 EACC 3EEF 5D21 63A8 B393
• Website and infrastructure (CSIRT): csirt@cra-response-center.de, OpenPGP key csirt.asc, fingerprint D82B 2661 BA06 B29D 7F56 71A2 F476 2447 105E 11D0
• Web form, anonymous if you wish: cra-response-center.de/security-contact/

Please send confidential information by e-mail, encrypted and signed. We handle reports in English and German. Helpful details are: the affected URL, component or version, a description, steps to reproduce, the possible impact and, if available, a proof of concept. Please give at least one way to contact you, preferably an e-mail address; we also accept a telephone number. Enquiries about the status of your report are welcome at any time.

3. What we consider a vulnerability

• The vulnerability affects our software, our services or our infrastructure.
• The information is, where possible, not yet publicly known.
• We do not treat results of automated tools or scans without verifiable evidence as a valid vulnerability.

We also accept and examine reports of vulnerabilities that have already been fixed.

4. Our commitments

• We treat every report confidentially to the extent permitted by law. This does not apply to information needed to disclose the vulnerability.
• We do not pass on your personal data to third parties without your explicit consent.
• We respond within the time limits in section 6.
• We will not file a criminal complaint against you as long as you follow this policy (safe harbour). This does not apply where criminal intent is evident.
• We remain available to you throughout the entire process.
• We do not require a non-disclosure agreement.
• If you wish, once the process is complete we will name you, by name or alias and with a reference of your choice, in our acknowledgements.

5. What we expect from you

• You do not exploit the vulnerability beyond what is needed to demonstrate it, and you cause no damage.
• You do not attack our systems, for example through social engineering, spam, denial-of-service attacks or password guessing (brute force).
• You do not alter or compromise third-party systems or data.
• You do not offer tools for exploiting the vulnerability, whether for money or free of charge.
• The name, alias and reference for the acknowledgements contain nothing offensive.

Anyone who does not comply will not be named in the acknowledgements. We will still handle the report as well as we can. Everyone involved treats each other with respect; there is no room for discrimination, sexism or insults.

6. Process and time limits

• Within 5 working days you receive a personal reply to your report or to any addition to it, not an automated acknowledgement.
• Within 10 working days you receive detailed feedback: whether we confirm or reject the vulnerability, specific follow-up questions, or an explanation of why the analysis is taking longer, with further feedback within another 10 working days.
• No report is closed by a single person; a second person reviews every decision.

These time limits do not apply to anonymous reports.

7. Anonymous reports

You can report anonymously via the web form. Without a way to contact you we cannot ask follow-up questions, so we can process anonymous reports only to a limited extent or possibly not at all. Complex matters in particular often need further explanation.

8. Actively exploited vulnerabilities

If a vulnerability in our software, our services or our infrastructure is being actively exploited, we inform the competent national CSIRT without undue delay (in Germany, CERT-Bund at the BSI) and coordinate further steps with it. For our products, we also report actively exploited vulnerabilities under Article 14 of Regulation (EU) 2024/2847, regardless of the status of this process.

9. Disclosure

We disclose confirmed vulnerabilities within 90 days. If there is a valid reason why a fix will take longer, we extend this period once by a further 90 days in close consultation with the national CSIRT; any further extension requires the CSIRT's agreement. We arrange disclosure, at least in ENISA's European Vulnerability Database (EUVD), in close consultation with the national CSIRT or ENISA. We agree the timing with you.

10. Closing the process

We consider a process closed when

• the information in the report proves to be unfounded,
• the vulnerability in a service has been fixed and disclosed,
• the vulnerability in our software has been fixed or mitigated by an update and disclosed,
• the reporter has not responded to follow-up questions for at least 30 days and the report therefore cannot be processed further, or
• the vulnerability has been disclosed and, after consultation with the national CSIRT, a fix can no longer be expected.

We inform you without undue delay when the process is closed, except in the case of anonymous reports.

11. Privacy

How we process your data when you submit a report is set out in our privacy policy.

Summary

CRA Response Center (provider: see legal notice). Version 1.0, created 8 October 2026, next review by October 2027 at the latest. This policy follows BSI TR-03183-3, section 4.4. It is also published in German at cra-response-center.de/security-policy/; the German version is authoritative.

Scope

The software and services of CRA Response Center and the website cra-response-center.de with its forms, tools and servers.

How to report

Products and services (PSIRT): psirt@cra-response-center.de, key psirt.asc, fingerprint 3920 2416 872C 3ADE 73A9 EACC 3EEF 5D21 63A8 B393. Website and infrastructure (CSIRT): csirt@cra-response-center.de, key csirt.asc, fingerprint D82B 2661 BA06 B29D 7F56 71A2 F476 2447 105E 11D0. Web form, anonymous if you wish: cra-response-center.de/security-contact/. Please send confidential information encrypted and signed. We work in English and German. Please include the affected URL, component or version, a description, steps to reproduce, the possible impact and, if available, a proof of concept, plus at least one way to contact you (e-mail preferred, telephone accepted). Status enquiries are welcome.

What we consider a vulnerability

It affects our software, services or infrastructure; it is preferably not yet public; results of automated tools or scans without supporting evidence do not qualify. We also check reports about issues that have already been fixed.

Our commitments

We treat every report confidentially to the extent permitted by law, except for information needed for public disclosure. We do not share your personal data without your explicit consent. We will not file a criminal complaint as long as you follow this policy, unless criminal intent is evident. We remain available throughout the process and never require an NDA. On request, we list you by name or alias with a reference of your choice in our acknowledgements.

What we expect from you

Do not exploit the vulnerability beyond what is needed to demonstrate it and cause no damage; do not attack our systems (social engineering, spam, denial of service, brute force); do not alter or compromise third-party systems or data; do not offer exploitation tools to anyone; keep names, aliases and references free of offensive content. Reporters who do not comply will not be acknowledged, but we still handle their reports as well as we can. Everyone involved treats each other with respect; there is no room for discrimination, sexism or insults.

Response times

A human replies within 5 working days to each report or addition (no automated reply). Detailed feedback follows within 10 working days: confirmation or rejection, specific questions, or an explanation of why the analysis is taking longer, with a further update within 10 working days. No report is closed by a single person. These times do not apply to anonymous reports.

Anonymous reports

You can report anonymously through the web form. Without a way to contact you we cannot ask questions, so anonymous reports can only be processed to a limited extent or possibly not at all.

Actively exploited vulnerabilities

We notify the competent national CSIRT (CERT-Bund at the BSI in Germany) without undue delay and coordinate with it. For our products we also report actively exploited vulnerabilities under Article 14 of Regulation (EU) 2024/2847.

Disclosure

Confirmed vulnerabilities are disclosed within 90 days, extendable once by 90 days in consultation with the national CSIRT and beyond that only with its agreement. We arrange disclosure at least in ENISA's European Vulnerability Database (EUVD) in close consultation with the national CSIRT or ENISA. We agree the timing with you.

End of the process

The process ends when the report proves unfounded; when a vulnerability in a service has been fixed and disclosed; when a vulnerability in our software has been fixed or mitigated by an update and disclosed; when the reporter has not responded to questions for at least 30 days; or when the vulnerability is public and, in consultation with the national CSIRT, a fix can no longer be expected. We inform you without undue delay, except for anonymous reports.

Privacy

See our privacy policy.