Reference
Report a security vulnerability
We welcome reports from security researchers and customers who find a vulnerability in Prismara or other SovSec services.
How to report
Section titled “How to report”| Item | Details |
|---|---|
| security@sovsec.com | |
| Machine-readable policy | /.well-known/security.txt |
| Languages | English or German |
Please include:
- A description of the vulnerability and its possible impact.
- The affected product, page address or component.
- Step-by-step instructions to reproduce it.
- Any proof-of-concept, screenshots or requests and responses, with other people’s data removed.
- How you would like to be credited, if at all.
Please do not report vulnerabilities through the support portal or by public channels.
What you can expect
Section titled “What you can expect”| Stage | What we do |
|---|---|
| Acknowledgement | We confirm we received your report. |
| Assessment | We investigate, confirm the issue and assess its severity, and may ask you for more detail. |
| Fix | We fix confirmed issues in priority order and keep you informed. |
| Disclosure | We agree with you when details can be made public, after a fix is available. |
Rules of engagement
Section titled “Rules of engagement”When researching, please:
- Do not access, change or delete other people’s data. If you reach data that isn’t yours, stop, don’t keep a copy, and tell us.
- Do not run denial-of-service tests or anything that degrades the service for others.
- Do not use social engineering, phishing or physical attacks against SovSec staff, customers or offices.
- Only test against accounts and data you own or have permission to use.
- Give us reasonable time to fix the issue before you share details with anyone else.
Safe harbour
Section titled “Safe harbour”If you act in good faith and follow this page, we will not pursue or support legal action against you for your research. We consider good-faith research that follows these rules to be authorised. If a third party takes action against you over research that followed this page, we will make it known that you acted in line with it.