Report a security vulnerability

We welcome reports from security researchers and customers who find a vulnerability in Prismara or other SovSec services.

Item	Details
Email	security@sovsec.com
Machine-readable policy	/.well-known/security.txt
Languages	English or German

Please include:

• A description of the vulnerability and its possible impact.
• The affected product, page address or component.
• Step-by-step instructions to reproduce it.
• Any proof-of-concept, screenshots or requests and responses, with other people’s data removed.
• How you would like to be credited, if at all.

Please do not report vulnerabilities through the support portal or by public channels.

Stage	What we do
Acknowledgement	We confirm we received your report.
Assessment	We investigate, confirm the issue and assess its severity, and may ask you for more detail.
Fix	We fix confirmed issues in priority order and keep you informed.
Disclosure	We agree with you when details can be made public, after a fix is available.

When researching, please:

• Do not access, change or delete other people’s data. If you reach data that isn’t yours, stop, don’t keep a copy, and tell us.
• Do not run denial-of-service tests or anything that degrades the service for others.
• Do not use social engineering, phishing or physical attacks against SovSec staff, customers or offices.
• Only test against accounts and data you own or have permission to use.
• Give us reasonable time to fix the issue before you share details with anyone else.

If you act in good faith and follow this page, we will not pursue or support legal action against you for your research. We consider good-faith research that follows these rules to be authorised. If a third party takes action against you over research that followed this page, we will make it known that you acted in line with it.

• Contact support
• System requirements