---
title: "Research & Disclosure: Security Advisories | Mr Cyber"
url: https://mr-cyber.com/research
language: en
description: "Security advisories from Mr Cyber after coordinated disclosure, and our policy: vendor first, 90-day default deadline, CERT-Bund if there is no response."
---

# Research & disclosure

Advisories are published here after coordinated disclosure.

## Reported so far

Vulnerabilities reported to

-   ![SCHUFA](/_a/Bvca6kXW.png)
-   Adobe
-   Infomaniak
-   DANA Indonesia
-   Zabbix
-   Icinga
-   Pi-hole
-   Jenkins
-   Prometheus
-   BMW
-   Doctolib

-   ![](/_a/Bvca6kXW.png)

Critical vulnerabilities found, responsibly reported, fixed.

## Responsible disclosure policy

1.  **Vendor first.** We report privately to the vendor, through its security.txt contact or its product security incident response team (PSIRT).
2.  **90-day default deadline.** We publish 90 days after the report. If the vendor is actively working on a fix, we extend the deadline.
3.  **No response?** Then we bring in CERT-Bund at the BSI to coordinate.
4.  **Never early.** We never publish before a fix is available or the deadline has passed.
5.  **Never client data.** We never use client data for research or advisories.

### Contact

Questions about an advisory, or a vulnerability to report to us:

-   [security@mr-cyber.com](mailto:security@mr-cyber.com)
-   [PGP key `985D 5AA6 9134 55F2 676E 5438 7E5E ADB8 547A C1ED`](https://mr-cyber.com/pgp-key.asc)
-   [security.txt](https://mr-cyber.com/.well-known/security.txt)