EACG Security Policy

Policy expires: 2027-01-10

At EACG we take the security of our services and products very seriously. The following sections help you find your way through our security support offerings.

Security Information

For information regarding the security of our services, you may:

• Follow our Atom feed on vulnerability disclosures: Vulnerability Disclosure Feed
• Read our security.txt (RFC 9116)
• Find tool-specific security information in the SECURITY.TXT file in the root of each code repository

Reporting a Vulnerability

Our preferred channel is the report form below. Please use email only as an exception, if the form does not work for you.

Report Form (preferred)

Report the vulnerability using our report form. All submissions are treated confidentially. You will receive a confirmation and we will follow up within 1 working day.

Report by email (exception only)

1. Email psirt@eacg.de with the subject Security Alert. Your email should include:
   • A description of the situation and a brief summary of the issue
   • Precise, detailed steps (including screenshots) that allow us to reproduce the issue
   • The affected tool(s) and version(s)
   • Demonstrated impact that goes beyond the currently logged-in user
   • Your environment details, if relevant
   • Any possible mitigations, if known
   • Your contact details, so we know whom to credit
2. Please encrypt your message using our public PGP key to prevent unwanted third-party access:
   EACG Public Key for Vulnerability Disclosure

   -----BEGIN PGP PUBLIC KEY BLOCK-----
   
   mQINBGrOVo0BEADXVJ3CxjUeWiP4a1HrC051mc3ZMg+tu+yCYEz+ZxKPINusT/PF
   G4VHilAN4NtmPIWTqsDl9GtH47Y/6RP3ynPvvXp2nMQkQc/LkEylWjbxyMYnY2ml
   RilLmHXWSFsQeHtXkUZK03MtObZ+Aij8EBxHXrNJmzeoRsDq1o6j4wWP72gEe2Vt
   daVIM4t9ewEALCNZQ0IBYwGXbFnIjncrC7Gi0R9bvm8QIRuZJwnCL9//eTX0Q4oC
   UUzjKk2ElL6OhZV6n8J6YcxeM7voX5kSUalBMPq32VVlZqNfvAGYzFONlT+YQlYY
   /5RvWJnzPKt0176vos+tRzCks0YTTYMPumDM9D42GFZqTrfHBwF5pDlBuxa9sNRw
   pr3NvsqVUd/JzYypfzaZadi9xCYrRDIPUA8lI086vX9QipThHfcilm9u3KeEW0hM
   qAFCDu4+K8M4ZjCue+a/PzV5+rqu8+1S0lMGhTRqf6ukmTuffvd55oL1YoykQaEi
   heLgz57aOSEJvBaXIemvBsI/+T0NhvYsUSDZVnov1Aob5lgC38QaP6tevqS0Qy8k
   SNYQil4cPvK+9SJSdDipJBJ65maToCpdv1rk3Dd/HoEPozE4DUcBkwPSv9NBsj8+
   qjVjtAdOS7vSo0h9E4fIzPfKQpdrnebsxah6KtfRRjaq1eqbP4ooTJPqgwARAQAB
   tB5FQUNHIFBTSVJUIEtleSA8cHNpcnRAZWFjZy5kZT6JAlQEEwEIAD4WIQSkR3B4
   U+6dbayY5uYyJsx+RZYLfQUCas5WjQIbAwUJB4YfRAULCQgHAgYVCgkICwIEFgID
   AQIeAQIXgAAKCRAyJsx+RZYLfVvbD/9JDUYsTee/FHTDCb5SEjAfjwgWwYTMEzTL
   7PY9nLd+fYbB8Kq6L8+oQTVr3lEHESJdk4hXy/HGFyzEtlHCQL33y3B5L429F+ug
   k1E3aZju1A3gTF/HnkHO7mI9OWiSnyOkbtpGobibWhOh8GJhfBCk9gN5+XazSmRU
   Iva1VDdEdOKKoQrtpCHx0kUc7zvSUgg5gbI+xAW0dAvvJEJ/TC8u1Q/QnzgG76cQ
   sufVjyK0KJq03/+qOivpmzpRTdjb1iniiL01AFoV+CvWqWTbNDuFuj1prgz//Tx+
   0jpuezmt2zY+pHXycM0IvXtFfLoYA105GI3Sd1ddOWID3Vq/6HXruZupXLLsRHUf
   Ruz0AkfL/iRDIbrNekI2+rCk4uRODpiQCwp+8V6ToiBfMvtLCjCb04MIc2be/9mx
   uvos+Ip2NHRQRnBN3jhakNaKrT/1/H3dH6CMF36+vwgdYUaSLe1Y2WxjEOGY63CW
   hV76soCBe1a4cZRd2kc/iuKv5VdcWCtb/et1+6q41JLmPPwqB84VNomuB3dw1ulm
   lGLU7Xd9+5oBu+HO1gEIEPGQawG5YVUMLa7lxkH9+wYrVd7TqDuv0gteK004YtyU
   tyFv6IDN5Ks7Tgvq2+bYJggJQsMt0q54gQVfrJyH8aUSCCRXx98dOZVcAG4iXNuw
   d7QzYpRSVrkCDQRqzlaNARAAwfv60l6R7iaEidUktjFX3+tt9AkjG5e73WKk4b4e
   I/Dn1gPCyDzGHI4so+VjGpyGr6Q+ahTNq7Qt4VWYhb3L3nx72aYlBZsh3ydPcZMl
   jC4p/4jdcHTk3o+pW5esKBFPmo1TRAPXTErSMCUf8ruPJkUceJIjdHvwLHUQuB9e
   tWN4cVWyIZos4951VSyv/IQHrPftCvH9fH42OqqX4h0gWAdIj8JFstpW1BlaaRlG
   bvFXmpJFxxFoKhCMq/wzXKCYABrWAnUtE8uoKNkGdFbP/9mDLqbKntgrJdGXJ74d
   2ZNEw0kn3CmkXon5nruF/l5QOdmrk3hAPCSAt6y1xooEjS9wuMRJX/zzqWYiKSDZ
   vt+WEet0pjiduWj/MdTSemQVLWdeJnrNr1zOdY4OTxcfQshdacxRennuJz9B7QkJ
   Y3ob9hp1M483uSBQn7mCRZFZrfXiQjYVRlLB9gUHG167vK+uAEWX4Y+eiorQAQoT
   YFY5bIA9j8tPrywdqA3hnLZqQYBSzeKgm5oP0EQIL6GU7LUeY9XKN1YvFSK1JwqC
   sbF+6asaPtuLvVUnvuzWqcq/aXlHeabzNLkLVgGMtYNcyyDNVz+8t4yJ5Dl9NcQq
   RVAX4yVqqwMr+pu/I9zY9kJMyLx2ZB2ShHoDbFDk+K8sVhyYQ2bcmi+6m0/wzliv
   SpsAEQEAAYkCOgQYAQgAJhYhBKRHcHhT7p1trJjm5jImzH5Flgt9BQJqzlaNAhsM
   BQkHhh9EAAoJEDImzH5Flgt9/LcP8Psh27svLzl+dV10CnpeUTlosEiIfY10s/cK
   DVlIWeNJIk68gPFMVr3+M6nV7JeDmN5vnkjwO760o3En9f3LsQfE9xm1PUxGz7JI
   HlMZULc5HxKquyZjYCaIkLDD82J6Hdc6BcISrqB2ixsML0rF+57D5JOb0l4HawwU
   rFUNc7RaAP/7F7DS9wDnrMmOJa0Z0eOyizUKJN1MtDuks71RUJa/gkU6dnu3QBYr
   kKW9NUeqBccSTyGp/RAnawK0H+3zKw2Fdb+9nZp6vGVQoTPZmCnb2ZDuaoDhVVz8
   H0ru3+WNkkBvDFdLFyBKSVhCORsov/HSTSd2olOCb4IStNuTGU7+h5vV25trVIwQ
   axQJ2uiXCMaOOUgs8w08SnAuJ7IGSwTj/xavwJ3OEAVxdDYgjxKc2RooobFqWRWc
   vYd/msMtuIafvglDyaJJa0MN7LQ97t/ZBMc2v6wwfRav/UYHVjKqRog2EVVXHzgJ
   cs6UNegiiVg9bzvfRvEPvHnVB9nBFpmQBMq5urxzAAI+I0c82bmAoxuN6wq8khVg
   V/Cmn7/Aoku8LfJm7ryAnLsG7AuuAThE6Lz2cUYBVDAsuRSTF+yCHXdtYX00ykuR
   C8zkaNtZJXEWxos7BZi0nv2rjnEAEBoRzqL81UpPXLy9tmMYH4sYHInjQG2LBwo7
   5dGqoA==
   =A49P
   -----END PGP PUBLIC KEY BLOCK-----

   Fingerprint: A447707853EE9D6DAC98E6E63226CC7E45960B7D

   How to encrypt using GPG

   1. Copy the full key above (including the -----BEGIN and -----END lines) and save it as eacg-pubkey.txt
   2. Save your message as myMsg.txt in the same directory
   3. Import the key: gpg --import eacg-pubkey.txt
   4. Encrypt your message: gpg --encrypt -r psirt@eacg.de -o myMsg.gpg myMsg.txt
   5. Attach myMsg.gpg to your email

   If GPG is not installed, download it from gpgtools.org.

3. You will receive a reply from one of our engineers within 1 working day acknowledging receipt.
4. We may contact you to further discuss the reported item and to understand its scope.

Disclosure Timeline

We process reports as quickly as possible. Depending on the complexity of documentation, impact assessment, and mitigation options, this may take some time. You may assume that we adhere to a maximum 90-day disclosure timeline.

Bug Bounty

We appreciate and credit all security researchers who support our security. We credit everyone who has successfully identified and reported a vulnerability. Occasionally we run a bug bounty programme — if you are interested in being invited, feel free to reach out at psirt@eacg.de.

We will not reward a bounty for reports that:

• Do not include responsibly demonstrated impact
• Require "disabling antivirus" or sending malware to a user
• Require bypassing normally expected security controls
• Concern vulnerabilities with an official patch released less than one month ago
• Concern self-XSS or XSS requiring unlikely user interaction
• Concern open redirect — unless additional security impact is demonstrated
• Require man-in-the-middle (MITM) attacks
• Concern tabnabbing
• Concern email configuration issues (SPF, DKIM, DMARC)
• Concern forced login/logout CSRF
• Concern account lockout via repeated incorrect password submissions
• Concern password complexity or account recovery policies
• Concern HTTPS mixed content
• Concern missing HTTP security headers (Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy)
• Concern the OPTIONS HTTP method being enabled

To earn a bounty, a serious issue report must be submitted demonstrating impact that goes beyond the current user session. We only honour business partners who are willing to identify themselves with a correct name and address. Payment requires a legitimate bank account in the international banking system — we cannot send payments via PayPal or cryptocurrency.