Coordinated Vulnerability Disclosure Policy

The security of our products is a core part of the quality we deliver. No matter how carefully software and hardware are developed, vulnerabilities can never be fully excluded. Rommelag SE & Co. KG therefore actively welcomes reports from security researchers, customers, partners, and the general public.

This policy describes our process for Coordinated Vulnerability Disclosure (CVD): the coordinated handling and publication of security vulnerabilities. It is published in accordance with the requirements of Regulation (EU) 2024/2847 (Cyber Resilience Act, CRA), Annex I Part II, and is aligned with the international standards ISO/IEC 29147 (Vulnerability disclosure) and ISO/IEC 30111 (Vulnerability handling processes).

We commit to:

• treating every report seriously, confidentially, and free of charge;
• not taking legal or commercial action against reporters who follow this policy;
• keeping reporters informed about the progress of their report;
• remediating confirmed vulnerabilities within a reasonable, risk-based time frame;
• publishing a security advisory for vulnerabilities that require action by our users.

We ask you to observe the following rules while researching and reporting. They exist to protect our customers, their data, and you.

• Do no harm. Do not degrade, interrupt, or destroy the availability, integrity, or confidentiality of our systems, services, or data.
• Minimum necessary access. Stop as soon as you have confirmed the vulnerability. Do not pivot further into the system, do not escalate privileges beyond what is needed for proof, and do not establish persistence.
• Protect personal data. Do not access, copy, modify, store, or publish personal data or customer data. If you encounter such data by accident, stop immediately, tell us about it in your report, and delete all copies.
• Use your own test data. Where possible, use accounts, devices, and data that belong to you or that we have provided for testing.
• No disruptive testing. No denial-of-service or stress testing, no spamming, no brute-force attacks against production systems, no automated high-volume scanning.
• No third parties. No social engineering or physical intrusion attempts against employees, customers, suppliers, or service providers.
• No extortion. Reports that are linked to a demand for payment, to a deadline for payment, or to a threat of publication as leverage are treated as extortion and not as a security report.
• Confidentiality until coordination. Do not disclose the vulnerability to third parties or to the public before the coordination process described in section 6 is complete.
• Comply with the law. Stay within the boundaries of applicable law at all times.

4.2 What your report should contain

The more precise your report, the faster we can reproduce and fix the issue. Useful information includes:

• the affected product, the exact version or firmware release, and the affected component;
• the configuration and environment in which you observed the issue;
• the vulnerability type (for example CWE class) and a technical description;
• a step-by-step description that allows us to reproduce the issue;
• proof of concept: request/response samples, log excerpts, screenshots, scripts, or a short video;
• your assessment of the impact and, if available, a CVSS v3.1 or v4.0 vector;
• the prerequisites for exploitation (network position, authentication, user interaction);
• whether the vulnerability is already publicly known or is being actively exploited;
• whether you have already reported it to another party (for example a CERT/CSIRT or a coordinator);
• your intended publication date, if any, and how you would like to be credited;
• contact details for follow-up questions.

• We publish an advisory as soon as a fix or an effective mitigation is available. Our default coordination window is 90 days from the acknowledgement of the report.
• If we cannot meet this window, we will contact you and propose a new date with reasons. We ask you to consider a reasonable extension where the technical complexity justifies it.
• If a vulnerability is already being actively exploited or has been made public by a third party, we may publish earlier – including before a full fix is available – in order to enable our users to protect themselves.
• After publication of the advisory you are free to publish your own write-up. We are happy to review a draft beforehand for factual accuracy, and we ask you not to include customer data or details that would enable attacks on unpatched installations.
• We publish advisories in a machine-readable format (CSAF 2.0) alongside the human-readable version, and reference the affected components via our SBOM and, where applicable, a VEX statement.

6.1 CVE identifiers

For vulnerabilities in our products we request a CVE identifier through the CVE Program and reference it in the advisory. If you have already obtained a CVE ID for the finding, please include it in your report so that we can avoid duplicates.

6.2 Credit

We are happy to credit you by name, by handle, and with your organisation and a link in the advisory – exactly as you wish. Let us know your preference in the report; if you prefer to stay anonymous, we will not name you. Rommelag SE & Co. KG does not currently operate a paid bug bounty programme; we do not offer any monetary reward for reports.

Rommelag SE & Co. KG regards security research that is conducted in good faith and in compliance with this policy as an authorised contribution to the security of our products, not as an attack.

If you comply with this policy, in particular with the rules of engagement in section 3, then Rommelag SE & Co. KG will:

• not initiate or support any civil or criminal proceedings against you in connection with your research and your report;
• not assert any claims against you under copyright law, competition law, or our terms of use in connection with acts that were necessary for the research;
• consider your activity as authorised access within the meaning of the applicable computer misuse provisions;
• make clear to any third party who initiates proceedings against you that your activity was covered by this policy, to the extent that this is legally possible for us.

This assurance covers only Rommelag SE & Co. KG. It cannot bind third parties – for example our customers, hosting providers, or public authorities – and it does not apply to acts that go beyond this policy. If you are unsure whether a specific test is covered, contact us at psirt@rommelag.com before you carry it out. We will answer such questions quickly and in good faith.

Our products contain third-party and open-source components. If you report a vulnerability in such a component:

• we assess whether and how the vulnerability is exploitable in our product and provide an updated or patched component;
• we forward the report to the upstream maintainer or vendor if it is not yet known there, and coordinate the publication with them – we will name you as the reporter towards upstream only with your consent;
• we document in our advisories and in our VEX statements which components are affected and which are not exploitable in our product.

If you find a vulnerability in an open-source project maintained by Rommelag SE & Co. KG, this policy applies as well.