Reporting vulnerabilities
The security of our users is very important to us. If you have identified a potential vulnerability in our services or related components, please report it through the channels listed below.
Reporting channels
We accept reports through the following channels
security.txt file (RFC 9116)
Report through the channels defined in our machine-readable security.txt file
https://certum.eu/.well-known/security.txt
We follow a Coordinated Vulnerability Disclosure (CVD) model in line with ISO/IEC 29147:2018 and ISO/IEC 30111:2019.
What we will do with your report
Acknowledgment of receipt
Within 3 business days, we will confirm that we have received your report.
1- 2
Initial analysis
We will analyze the impact of the reported vulnerability on the product's security functions.
Feedback
Within 3 business days of acknowledging receipt, we will let you know how we intend to proceed (accepting the report, requesting additional information, or explaining why the report is being closed).
3- 4
Fix and patch release
If the vulnerability is confirmed, we will develop and release a patch in accordance with our internal vulnerability management procedure. The time frame depends on the severity rating (CVSS).
Advisory publication
Once the patch has been released, we will publish an advisory at https://www.certum.eu/en/security-advisories/ and notify the reporter.
5
What to include in your report
To help us speed up our analysis, please include as much of the following information as possible:
the product name and version
(SimplySign SAM, SmartSign),- the environment in which the vulnerability was observed (operating system, network configuration),
- detailed steps to reproduce
(proof of concept), if possible, - an assessment of the potential
impact and the vulnerability category.
Protecting vulnerability information
We classify information about reported vulnerabilities according to the Traffic Light Protocol (TLP, https://www.first.org/tlp/) and treat it as confidential until the advisory is published. External communication about confirmed vulnerabilities takes place only after coordination with the reporter and, where appropriate, with the Certification Body and the EUCC Certificate Holder.
Safe harbor
for reporters
Reporters acting in good faith:
- receive an acknowledgment of receipt and updates on the progress of their report,
- may be credited in the acknowledgments section once the patch is released (with their consent),
- will not face legal action from us, provided they act within the scope of our Vulnerability Disclosure Policy (VDP).