Skip to content

Research & disclosure

Advisories are published here after coordinated disclosure.

Reported so far

Vulnerabilities reported to

  • SCHUFA
  • Adobe
  • Infomaniak
  • DANA Indonesia
  • Zabbix
  • Icinga
  • Pi-hole
  • Jenkins
  • Prometheus
  • BMW
  • Doctolib

Critical vulnerabilities found, responsibly reported, fixed.

Responsible disclosure policy

  1. Vendor first. We report privately to the vendor, through its security.txt contact or its product security incident response team (PSIRT).
  2. 90-day default deadline. We publish 90 days after the report. If the vendor is actively working on a fix, we extend the deadline.
  3. No response? Then we bring in CERT-Bund at the BSI to coordinate.
  4. Never early. We never publish before a fix is available or the deadline has passed.
  5. Never client data. We never use client data for research or advisories.

Contact

Questions about an advisory, or a vulnerability to report to us: