Coordinated Vulnerability Disclosure Policy 

The term [Manufacturer Name] in this policy refers collectively to the affected companies listed below:

• datakamp System GmbH & Co. KG.
• Eidos S.r.l.
• Etipack Spa
• Etipack B.V.
• Logopak Systeme GmbH & Co. KG
• Logopak East Sp. z o.o.
• Logopak B.V.
• Logopak Sistemas, S.L.
• Société Logopak S.A.S.
• LSS Etikettering A/S
• Novexx Solutions GmbH
• Novexx Solutions SAS
• Novexx Solutions B.V.
• Novexx Etiketleme Sistemleri A.S.

This policy explains how to report vulnerabilities to us, what to expect after reporting, and what testing activities are permitted. 

This policy applies to all products of [Manufacturer Name] that have been published to customers.

Out of scope: 

• Third-party systems not produced, included or operated by [Manufacturer Name].
• Products that are no longer supported.
• Social engineering, physical attacks, and spam against employees or customers.
• Purely theoretical vulnerabilities that are not exploitable in the context of our concrete product, for example, as generated by an automated vulnerability scanner.
• Findings based solely on the presence of outdated third-party components (e.g. libraries, frameworks, web servers, operating systems), unless the issue can be shown to affect our concrete product in a meaningful and exploitable way.
• Generic hardening observations, for example, TLS configuration preferences, unless they result in an exploitable security weakness in our concrete product.

Please report vulnerabilities to psirt@support.possehl-secure.de. 

We support S/MIME and PGP/GPG encryption: 

• S/MIME public key: https://www.possehl-secure.de/smime-key.txt
• PGP public key: https://www.possehl-secure.de/pgp-key.txt

Please include: 

• A clear description of the issue.
• The affected product and version number.
• Steps to reproduce.
• A description of any helpful proof-of-concept code, logs, screenshots or videos that are available. If files larger than 10 MB are useful for the report, a link to an upload area will be provided.
• Your contact details, if you want a response.
• If the report contains content that may include potential malware, please provide it as an encrypted ZIP file with the password “infected”.

If you believe the issue is actively exploited, please state that in your report. 

We consider the following research activities to be acceptable when conducted in good faith, with reasonable care, and in compliance with this policy: 

• Testing only against in-scope systems.
• Using non-destructive methods.
• Accessing only the minimum data needed to demonstrate the issue.
• Stopping once the vulnerability is confirmed.
• Reporting the issue promptly and privately.

The following activities are prohibited unless we have given prior written authorisation: 

• Exfiltrating, modifying, or deleting user, customer or company data.
• Persistently accessing systems or accounts.
• Disrupting service availability or degrading performance.
• Pivoting to other systems or accounts.
• Using the vulnerability to extort, threaten, or embarrass [Manufacturer Name] or their customers.
• Public disclosure before we have had a reasonable opportunity to address the issue, except where required by law or where immediate disclosure is necessary to prevent harm.

When you report a vulnerability in good faith and in accordance with this policy, we will: 

• Triage the report and assess the impact.
• Keep you informed of progress, where appropriate and if desired.
• Coordinate remediation and, where feasible, publication.
• Recognise your contribution, if you request credit and we agree it is appropriate.
• We do not operate a bug bounty program and do not offer monetary compensation for vulnerability reports.
• We will not initiate legal action against individuals who act in good faith and follow this policy.

Our goal is to handle reports efficiently and transparently. Typical milestones are: 

• Acknowledgement of receipt: within 1 business day.
• Initial assessment: within 3 business days.
• Status update: as needed, especially if remediation takes longer.
• Coordinated disclosure: agreed with the reporter, taking into account risk to users and operational constraints. 

• The Coordinated Vulnerability Disclosure Policy is reviewed and updated regularly to ensure its effectiveness and efficiency.
• The effectiveness of the procedures is regularly reviewed to ensure continuous improvement and adaptation to new requirements.