Responsible Vulnerability Disclosure

The security of our systems and the protection of our customers’ data are of great importance to the Neuroth Group. 

Despite comprehensive security measures, vulnerabilities can never be completely ruled out. If you discover a potential security vulnerability in a system or service of the Neuroth Group, we ask you to report it to us responsibly and confidentially. 

Through our Coordinated Vulnerability Disclosure Process (CVDP), we aim to provide security researchers with a safe and structured way to report vulnerabilities and to support their timely remediation. 

Reporting a Vulnerability 

Please send your report to: 

[email protected] 

Where possible, please include the following information: 

• affected system, application or URL 

• brief description of the vulnerability 

• reproducible steps 

• potential impact 

• where appropriate, a non-destructive proof of concept 

Where possible, please do not include personal data, credentials or other sensitive information in your initial report. If such information is required for further analysis, we will coordinate an appropriate communication channel with you. 

Guidelines for Security Research 

We ask you to limit your research to what is strictly necessary to identify and verify a vulnerability. 

In particular, we expect you to: 

• not disrupt systems or services or otherwise affect their availability, 

• not modify or delete data, 

• access only the data that is strictly necessary to verify the vulnerability, 

• not download, store or disclose personal or other confidential data unless strictly necessary for a minimal proof, 

• immediately stop testing if sensitive data or a greater level of access than expected becomes visible, 

• not perform social engineering, phishing, DoS/DDoS or physical attacks, 

• not disclose information about a vulnerability to third parties or publish it before coordinating disclosure with Neuroth. 

If you are unsure whether a particular action is appropriate as part of your research, please contact us before proceeding with further testing. 

Scope 

The Responsible Disclosure Process applies to publicly accessible systems, applications and services operated by or under the responsibility of the Neuroth Group and to which this Policy applies. 

Vulnerabilities in third-party products or services should generally also be reported to the respective provider. If such a vulnerability directly affects data, access credentials or systems of the Neuroth Group, we additionally ask you to inform us confidentially. 

Out of Scope 

Not every technical issue constitutes a security vulnerability within the meaning of this Policy. In particular, the following issues are generally considered out of scope unless they result in a specific and demonstrable security risk: 

• functional defects as well as purely UI/UX-related issues, display errors or spelling mistakes, 

• missing or incomplete email security configurations such as SPF, DKIM or DMARC, 

• missing or suboptimally configured HTTP security headers such as CSP, HSTS, X-Frame-Options or X-Content-Type-Options, 

• general SSL/TLS configuration recommendations without demonstrated exploitability, 

• clickjacking or UI redressing on pages without security-relevant or sensitive actions, 

• self-XSS or vulnerabilities that can only be exploited through deliberate action by the affected user, 

• missing cookie attributes on non-security-relevant cookies, 

• open redirects without demonstrated security-relevant impact, 

• version information, banners, error messages, stack traces or directory information, unless they expose sensitive information or enable a specific attack, 

• missing rate limits on non-security-critical functions without a demonstrated abuse scenario, 

• vulnerabilities affecting only outdated or unsupported browsers, operating systems or software versions, 

• automatically generated scanner results without reasonable verification or demonstrated security impact. 

If a specific vulnerability in one of these areas can be demonstrated to have relevant effects on the confidentiality, integrity or availability of Neuroth Group systems or data, the report may nevertheless be reviewed under this Policy. 

What You Can Expect from Us 

We treat qualified reports confidentially and have them reviewed by our Security Team. 

We generally acknowledge receipt of a report within a few business days and, where possible, provide information on further progress and remediation. 

If you act in good faith and comply with the principles described in this Policy, Neuroth will generally not take legal action against you solely as a result of such security research. 

Security researchers who act responsibly make an important contribution to improving the security of our systems. 

CVDP and Bug Bounty 

Our Coordinated Vulnerability Disclosure Process is not a bug bounty program. Reporting a vulnerability does not create any entitlement to financial compensation or any other consideration. 

In exceptional cases, Neuroth may, at its sole discretion, voluntarily recognize particularly relevant vulnerabilities that have been reported responsibly. Whether and in what form such recognition is provided is decided by Neuroth exclusively on a case-by-case basis. 

There is no prior commitment or guarantee of financial or other compensation. Any voluntary recognition does not create an entitlement in relation to future reports.