Coordinated Vulnerability Disclosure (CVD) Policy

11 September 2026

How deZem deals with vulnerability disclosures by third parties

When developing software and hardware, vulnerabilities cannot be completely excluded, even when security measures (secure design and development process, testing, tooling, etc.) are implemented. It is therefore our policy to welcome well-founded vulnerability reports by security researchers.

This policy describes the process for dealing with vulnerabilities of our products, systems and services discovered by a security researcher. The objective is to close the vulnerability quickly based on a trusting and constructive dialog with the security researcher as well as communicating transparently to the outside such that harm is prevented or at least minimised.

Our process for dealing with vulnerability disclosures works through the following stages described in more detail below:

Vulnerability reporting
Vulnerability evaluation
Publication and mitigation of vulnerability

Vulnerability reporting

Security researchers, if you identified a vulnerability, please report it to us using our web form. The form also allows for anonymous reporting (this would however prevent us from contacting you for further details and feedback).

We promise:

To keep each vulnerability report confidential to the extent permitted by law;
not to pass on personal data to third parties without your explicit consent and to delete personal data one year after publication of the vulnerability;
to give feedback on every vulnerability report relevant to deZem products, systems or services, if it meets the expectations formulated below;
not to pursue criminal charges against you as long as you have complied with this Policy. This does not apply if recognizable criminal intentions have been or are being pursued;
deZem stays in contact with you for a trusting exchange throughout the entire process.

We expect from you:

Sufficient details in order to locate, reproduce and validate the vulnerability – see information to be provided in our web form.
The vulnerability found was not abused by you (reporter).
No attacks (such as social engineering, spam, (distributed) denial of service or „brute force“ attacks, etc.) were carried out exploiting the vulnerability.
No manipulation, compromise or modification of possible systems or data of third parties was carried out.
No tools for exploiting vulnerabilities have been offered for a fee or free of charge that third parties could use to commit crimes.
The vulnerability reports are not results of automated tools or scans without supporting documentation. These are not valid vulnerability reports.
The vulnerability report relates to previously unknown information. Your report will be checked for vulnerabilities that have already been fixed, but they do not qualify for further processing as part of the CVD process.
Good communication is important during a CVD case, vulnerability reports without communication options (i.e. valid contact data) can only be processed to a limited extent. In the case of complex vulnerabilities in particular, we may need further explanations and documentation. In the case of complex vulnerabilities in particular, we may need further explanations and documentation.

Vulnerability evaluation

deZem performs a first evaluation all vulnerability reports received according to the following criteria:

Does the vulnerability relate to our products, systems or services?
Does the report include adequate technical specifications and details?
What is the severity? Is it not negligible?
Is the vulnerability so far unknown?
Have our requirements for vulnerability reporting (see above) been met?

We will not pursue the vulnerability further if these criteria are not satisfied. If they are, we start validating and verifying the vulnerability.

In the event of actively exploited vulnerabilities, we will coordinate with the corresponding national CSIRT.

Unless the vulnerability report was issued anonymously, we guarantee an initial, qualified response within 5 working days and detailed feedback within 10 working days. We might ask for more detailed information and will keep you updated during the evaluation process. Ultimately, we either confirm or reject the vulnerability report and if need be start working on mitigation or fixing the vulnerability.

Publication and mitigation of vulnerability

Validated and verified vulnerabilities of published products, systems or services of deZem will receive a unique ID. They will be publicly disclosed within 90 days together with recommended mitigation measures – unless there is a good reason for not doing so, in which case we coordinate with our national CSIRT.

The CVD process terminates when the vulnerability is mitigated or fixed, has been publicly disclosed, or if the reporter fails to respond to technical queries for at least 30 days. We will inform the reporter accordingly.