Write to sven.nickel@gmail.com. Every report gets read, including the ones that turn out to be harmless.
Coordinated vulnerability disclosure policy
I acknowledge receipt within 72 hours.
I come back with a first assessment within 14 days — even if that assessment is that I cannot say yet.
I ask for 90 days before publication so that a fix can reach users. If the flaw is being actively exploited, that deadline does not apply — then speed is what counts.
Anyone who reports responsibly will be credited on request. No legal action will be taken over good-faith security research.
Support period
Security updates are provided until 2031-09-19 (at least five years from the placing on the market of the respective version).
A bill of materials in CycloneDX 1.6 format is kept current and forms part of the technical documentation. Market surveillance authorities receive it on request via the address above.