Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

Organisation: m-privacy GmbH
Security contact: support@m-privacy.de
Security advisories: https://www.m-privacy.de/security/advisories/
Responsible team: m-privacy Security Team

1. Purpose

m-privacy GmbH takes the security of its products and the protection of its customers seriously.
This Vulnerability Disclosure Policy describes how security researchers, customers, partners, and other third parties can report potential vulnerabilities affecting m-privacy GmbH products and how such reports are handled.
Our objective is to investigate, remediate, and disclose vulnerabilities in a responsible and coordinated manner.

2. Scope

This policy applies to currently supported products developed and maintained by m-privacy GmbH.
The scope includes, in particular, the following product families:

  • TightGate-Server
  • mp-Server

Products that have reached end of support or end of life are not covered by this policy unless explicitly stated otherwise.
Products or components maintained by third parties are generally outside our scope. If a report concerns a third-party component, we will, where reasonably possible, assist in identifying the responsible vendor or CVE Numbering Authority.

3. Reporting a Vulnerability

Potential security vulnerabilities may be reported confidentially to the m-privacy Security Team:

Email: support@m-privacy.de
A PGP key is available for encrypted vulnerability reports.
GnuPG-Key: CA191389.asc [2 KB]
Fingerprint: 6F49 E3A2 C203 CD85 81E2 1A91 2E4F 0F29 CA19 1389

Where possible, please include:

  • affected product;
  • affected version or versions;
  • description of the vulnerability;
  • steps required to reproduce the issue;
  • prerequisites for successful exploitation;
  • potential security impact;
  • proof of concept, if available;
  • relevant logs, screenshots, or other technical information;
  • whether the vulnerability has already been reported to another party;
  • whether any details have already been publicly disclosed;
  • whether you would like to be credited in a subsequent advisory.

Please do not provide personal data or production customer data unless strictly required for the security analysis.

4. Our Response

m-privacy GmbH aims to acknowledge qualified vulnerability reports within two business days.
The m-privacy Security Team will then:

  • review and triage the report;
  • attempt to reproduce the vulnerability;
  • identify affected products and versions;
  • request additional technical information where necessary;
  • provide meaningful status updates to the reporter;
  • coordinate remediation or mitigation;
  • assign a CVE ID where appropriate;
  • coordinate disclosure.

The time required for investigation and remediation depends on technical complexity, severity, and the affected product versions.

5. Coordinated Vulnerability Disclosure

m-privacy GmbH supports coordinated vulnerability disclosure.
We ask security researchers to keep details of an unresolved vulnerability confidential and coordinate public disclosure with us.
As a general guideline, we aim for coordinated disclosure within 90 days after confirmation of the vulnerability.

This period may be shortened or extended in coordination with the reporter, particularly where:

  • active exploitation has been identified;
  • earlier disclosure is necessary to protect users;
  • development, testing, or deployment of a fix requires additional time;
  • third-party dependencies are involved;
  • multiple products or product versions are affected.

6. CVE Assignment

Once m-privacy GmbH has been approved as a CVE Numbering Authority, it may assign CVE IDs to vulnerabilities within its approved CNA scope.
The proposed CNA scope is:

Vulnerabilities in supported products developed and maintained by m-privacy GmbH, including TightGate-Server and mp-Server.

A CVE ID may be assigned where a vulnerability meets the applicable requirements of the CVE Program and public disclosure has occurred or is planned.
Not every defect or security-related issue necessarily qualifies for a CVE ID. Assignment decisions are made in accordance with the current rules of the CVE Program.

7. Security Advisories

m-privacy GmbH publishes security advisories at:

https://www.m-privacy.de/security/advisories/

Where applicable, advisories contain:

  • CVE ID;
  • affected product;
  • affected versions;
  • fixed versions;
  • technical description;
  • security impact;
  • exploitation prerequisites;
  • workaround or mitigation;
  • update information;
  • CWE classification;
  • CVSS v4.0 rating;
  • references;
  • reporter credit where requested.

8. Responsible Security Research

m-privacy GmbH welcomes responsible security research conducted in good faith for the purpose of improving the security of our products.
Researchers are asked to:

  • avoid unnecessary impact on systems or users;
  • not modify or delete data;
  • access no more data than necessary to demonstrate the vulnerability;
  • avoid bypassing security controls beyond what is necessary for investigation;
  • refrain from social engineering of employees, customers, or partners;
  • refrain from denial-of-service attacks against production systems;
  • comply with applicable law;
  • report vulnerabilities to us confidentially before public disclosure.

9. Recognition and Credits

At the reporter’s request and with their consent, m-privacy GmbH may credit the researcher or organization in the corresponding security advisory.
Credits will only be published with the reporter’s consent.

10. Bug Bounty

m-privacy GmbH currently operates no bug bounty program.
Submitting a vulnerability report therefore does not create an entitlement to financial or other compensation.

11. Contact

m-privacy GmbH 
m-privacy Security Team

E-Mail: support@m-privacy.de
Advisories: https://www.m-privacy.de/security/advisories/