Coordinated vulnerability disclosure policy

Scope

This policy covers all products of Telefonbau Behnke GmbH during their support period. This includes firmware, software and services, and the third-party components they contain. Our websites and internal IT are out of scope. We still welcome reports about them at security@behnke.support.

How to report

• Use the form at https://security.behnke.support. You may report anonymously.
• Or write to security@behnke.support. Please encrypt with our OpenPGP key, which is linked on the reporting page and in our security.txt.

Please name the product and version, describe the issue and the steps to reproduce it, and state the impact you observed. We cannot process plain lists of CVE numbers or unverified scanner output.

What we commit to

If you give us contact details:

• You receive a personal acknowledgement within 5 working days.
• Within 10 working days, you receive a substantive response: confirmed, not confirmed with reasons, or a status with the next date.
• After that, we update you at least every 10 working days until the report is closed.

Working days are Monday to Friday, excluding public holidays in Saarland, Germany.

We agree the publication date with you. We publish a security advisory no later than 90 days after confirming the vulnerability. If no remedy is possible by then, we may extend this once by up to 90 days, in coordination with CERT-Bund (BSI).

These deadlines do not apply to anonymous reports, because we cannot reach you. You can follow the status through your status link.

What we ask of you

• Access data only as far as needed to demonstrate the issue. Do not modify or delete data.
• Do not disrupt the service of others. Test only on installations you own or are authorised to test.
• No social engineering, physical attacks or denial of service.
• Do not disclose anything before the agreed date.

Safe harbour

If you search and report in good faith and within this policy, we will not take legal action against you for that research and report.

Third-party components

If the issue lies in a component we use, we report it to its manufacturer or maintainer and share our fix with them. We pass on your name only with your consent.

Actively exploited vulnerabilities

If a vulnerability is actively exploited, we notify it under Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act). We then also coordinate disclosure with the responsible CSIRT.

Security advisories

Published security advisories are available at https://security.behnke.support/en/advisories. Machine-readable versions are available as CSAF 2.0 under /.well-known/csaf/.

Rewards

We do not run a bug bounty programme and do not pay rewards.