Security
How to report a vulnerability to us — and what happens next.
Reporting a vulnerability
If you have found a weakness in one of our products or on this website, please report it to:
Please report vulnerabilities to this address only, not publicly, so that we can fix the issue before it is exploited.
The same details are available in machine-readable form at
/.well-known/security.txt (RFC 9116).
Scope
- the fairEXA Institute software suite (fairEXA Identity, Studio, Relay, Ink, Stage, Flow, Insight, Cast and Journey)
- the website
www.fairexa.de - services we operate ourselves for customers under contract
Third-party systems are out of scope, even where they run our software. In that case please contact the operator first; we are happy to put you in touch.
What we need
A good report contains:
- a description of the vulnerability and its likely impact
- the affected product and version, or the affected URL
- step-by-step instructions to reproduce it
- optionally: logs, screenshots, a proof of concept
- how to reach you, and whether you would like to be credited
German, English and French are all welcome.
What you can expect from us
| Step | Target |
|---|---|
| Acknowledgement of receipt | within 3 working days |
| Initial assessment (validity, severity) | within 10 working days |
| Status update while we work on it | at least every 14 days |
| Coordinated disclosure | normally within 90 days of receipt |
We keep you informed of progress and agree the timing of any publication with you. We are glad to credit you as the finder; equally, you may stay anonymous.
Statutory reporting obligations
As a manufacturer of products with digital elements we are subject to the Cyber Resilience Act (Regulation (EU) 2024/2847). When we become aware of an actively exploited vulnerability or a severe security incident, we report it to ENISA and the relevant CSIRT under Art. 14 CRA — an early warning within 24 hours and a vulnerability notification within 72 hours. We do not pass on your personal data as part of that.
Rules for security research
We will not pursue anyone acting in good faith who follows these rules:
- do not affect availability (no denial of service, no load testing)
- do not access other people’s data beyond what is needed to demonstrate the issue — in particular no examination or personal data
- do not modify or delete data
- no social engineering, no physical access, no phishing against staff or customers
- no publication before the agreed date
This commitment covers systems in the scope above only. We cannot indemnify anyone against breaches of applicable law.