Coordinated Vulnerability Disclosure

Scope

This policy applies to products with digital elements placed on the market by Stercom Power Solutions GmbH under its own name, including products already delivered.

Reporting a vulnerability

• Form on this page
• E-mail: security@stercom.de, encrypted with the PGP key published below or unencrypted
• Post: Stercom Power Solutions GmbH, keyword “Security”, address see legal notice

Reports are reviewed on working days. Every report receives an acknowledgement and, once recorded, a reply with a case number and contact person. Anonymous reports are accepted; a reply requires a means of contact.

Helpful information
Where known: description and possible impact, affected product (type designation from the rating plate) and software version, steps to reproduce, indications of public disclosure or active exploitation, contact details and preferred form of acknowledgement.

Handling
The reporter is informed of every change in status, including dependencies on third-party components. Vulnerabilities are remediated without undue delay. Security updates are made available without undue delay and free of charge during the support period. In the case of actively exploited vulnerabilities, affected users are informed without undue delay and the reporting obligations under Article 14 of Regulation (EU) 2024/2847 are fulfilled. No further deadlines are committed to.

Coordinated disclosure
A security advisory containing a description, the affected products and versions, impact, severity and remediation guidance is published when the update or an effective mitigation is made available. The timing is agreed with the reporter. Until then, the reporter is asked to keep the information confidential. Where remediation takes longer, the reporter is offered a publication date. Until an actively exploited vulnerability is remediated, information may be limited to the affected customers.

Acknowledgement and safe harbour
Reporters are named in the security advisory on request. There is no bug bounty programme.

No legal action is taken against reporters acting in good faith. A reporter acts in good faith if they limit testing to what is necessary to demonstrate the vulnerability, do not read or modify third-party data, do not impair productive systems, report before publishing and make no demands. This commitment does not bind third parties.

PGP key
PGP encryption is currently being set up. The public key and fingerprint will be published here once available.

Fingerprint: ---

Key: ---

Last updated: ---