Product Security / PSIRT

This policy applies to all publicly accessible GRIMME systems, applications and services, unless expressly excluded. 

Not covered: 

• Denial-of-service (DoS) or load testing
• Social engineering
• Physical attacks
• Attacks on third parties or suppliers 

Incoming vulnerability reports are handled centrally by the GRIMME Product Security Incident Response Team (PSIRT). 

The PSIRT is responsible for: 

• receiving and documenting reports
• technically assessing and prioritising vulnerabilities
• co-ordinating internal analysis and remedial measures
• co-ordinating external communication of security-related information 

We support responsible security research and undertake not to take legal action against individuals who act in good faith and comply with this policy. 

This applies in particular under the following conditions: 

• No third-party data shall be accessed, altered or exfiltrated, except where this is unavoidable and strictly necessary to demonstrate the vulnerability.
• No systems are deliberately compromised (e.g. through DoS attacks, data deletion or service disruption).
• Any vulnerabilities discovered are reported to us immediately and confidentially, and are not disclosed publicly before we have had sufficient time to rectify them. 

Subject to these terms, we regard your activities as authorised and will not take any civil or criminal action. Should sensitive data be inadvertently affected, we expect you not to store, disclose or otherwise use it, and to inform us immediately. 

Please note that this Safe Harbour does not apply to activities that contravene applicable law or go beyond the terms set out above. 

GRIMME adheres to the principle of coordinated vulnerability management. All reports received are treated confidentially and are reviewed, assessed and prioritised by the PSIRT. The external disclosure of security-related information is coordinated and takes place only once the assessment has been completed and appropriate remedial measures have been implemented. The aim is to minimise risks for customers and operators and to avoid the disclosure of unverified or unpatched vulnerabilities. 

In the case of reportable vulnerabilities or security incidents, we reserve the right to pass on information to the relevant authorities and regulatory bodies in accordance with applicable legal requirements.  

Please note that, due to legal requirements, confidentiality obligations or ongoing investigations, we may not be able to disclose all details regarding reported vulnerabilities or provide the full status of their handling.  

It may therefore well be the case that feedback to the reporter is only provided following a final assessment or upon the publication of a security advisory.