Report a vulnerability

How to reach us

• Email: security@blackfort-tec.de
• Postal address: Blackfort Technology Unternehmergesellschaft (haftungsbeschränkt), Ernst-Robert-Curtius-Straße 8a, 53117 Bonn, Germany

Every report is read by a person. You can write in German or English. If you would like to communicate in encrypted form, send us a short message without details and we will agree on a channel.

Helpful details: affected product and version, a description of the vulnerability, steps to reproduce, possible impact and how we can reach you. Please do not send us personal data of third parties.

What happens next

1. We confirm receipt within 2 working days and name a contact person.
2. Within 10 working days we tell you our assessment and the next steps.
3. Until publication you receive an update at least every 14 days.
4. If the vulnerability is confirmed, we fix it. We provide security updates to our customers free of charge during the support period of the product concerned, unless otherwise agreed for a tailor-made product.
5. We then publish a security advisory, coordinated with you. Our aim is to publish no later than 90 days after receipt. If our customers need more time to install the update, we propose a later date to you with our reasons and agree it with you.
6. If you wish, we credit you in the advisory.

Working days are Monday to Friday, excluding public holidays in North Rhine-Westphalia. These timelines are our commitment for the normal case. If we cannot meet one, we tell you and name a new date.

If a vulnerability is already being actively exploited, we inform the affected customers without undue delay and meet our reporting obligations under Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act).

You can also contact the German Federal Office for Information Security (BSI), which is designated as the coordinator for coordinated vulnerability disclosure in Germany: https://www.bsi.bund.de/CERT-Bund/

What we ask of you

• This page does not authorise you to test or access systems of Blackfort Technology or third parties. Please examine our products in your own environment and with your own data.
• If you come across data that does not belong to you, view no more of it than necessary, do not modify or delete anything, and tell us what you accessed.
• No denial-of-service attacks, no social engineering, no testing against our customers' installations.
• Give us the opportunity to fix the issue before you publish details.
• We do not pay bounties.

Your data

We use your details to handle the report and to document the fix (Art. 6(1)(f) GDPR). We pass only technical details to manufacturers of affected components or to the BSI; your name and contact details only with your consent. Likewise, we credit you in an advisory only if you wish. More in our privacy policy.

Security advisories

We publish fixed vulnerabilities here, with identifier, affected and fixed versions, severity and remediation.

Published advisories: none at present.