TECHDOCK GmbH takes the security of its products and services seriously. If you believe you have found a vulnerability in something we build or operate, we want to hear from you. This policy explains what is in scope, how to report, what you can expect from us, and the legal safe harbour we grant to good-faith researchers.
Machine-readable contact details: techdock.ch/.well-known/security.txt (RFC 9116).
Scope
This policy covers all products and services that TECHDOCK GmbH develops or operates: this website, our cloud services, the software we distribute and the firmware of our devices. If you are unsure whether something is in scope, ask us first.
Out of scope
The following is not authorised under this policy:
- denial-of-service or any test that degrades availability, including load testing
- social engineering, phishing or physical attacks against our staff, offices or customers
- access to accounts, customer instances, devices or data that are not your own or not explicitly provided to you for testing
- automated mass scanning that produces significant traffic
- reports that only cite missing best-practice headers, version banners or scanner output without a demonstrated impact
Our cloud services run as separate instances per customer. Testing against a customer instance requires that customer's consent. If you obtain access to data that is not yours, stop immediately, do not store or share it, and tell us.
How to report
Send your report to security@techdock.ch. You may encrypt it with our OpenPGP key, published at techdock.ch/.well-known/pgp-key.txt and on keys.openpgp.org. Encryption is optional; an unencrypted report is fine.
Please include what you can of the following:
- the affected product, host or component and, if known, the version
- steps to reproduce, ideally a minimal proof of concept
- the impact you observed or expect
- how you would like to be credited, or that you prefer to stay anonymous
We accept reports in English and German. If you prefer to report through a national coordinator, you can contact the Swiss Federal Office for Cybersecurity (BACS/NCSC), which operates a coordinated vulnerability disclosure process at bacs.admin.ch. We accept its coordination.
What we promise
- We confirm receipt within 2 working days.
- We give you a first assessment, including whether we consider the finding valid and how severe, within 5 working days.
- While the issue is open we send you a status update at least every 30 days.
- We fix confirmed vulnerabilities according to severity and inform affected customers.
- We treat your report and your identity confidentially and do not pass your personal data to third parties without your consent, unless the law requires it.
- We do not pay bug bounties. On request we credit you by name or handle in the advisory we publish once the issue is resolved.
Our office hours are Monday to Friday, Swiss business days. Working days above refer to these.
Coordinated disclosure
We ask that you give us 90 days from our confirmation of receipt before you publish details of the vulnerability. If a fix is available earlier, we will tell you and you may publish sooner. If a fix needs longer, for example because it requires a firmware release cycle or coordination with upstream projects, we will explain why and agree a new date with you. We publish a short advisory for resolved vulnerabilities that affect customers.
Safe harbour
TECHDOCK GmbH regards security research carried out in good faith and in accordance with this policy as authorised. For such research we will not file a criminal complaint, in particular under Articles 143, 143bis and 144bis of the Swiss Criminal Code, and we will not bring civil claims against you, including under copyright, data protection or trade secret law. If a third party takes legal action against you for research that complied with this policy, we will confirm that you acted with our authorisation.
Good faith means that you:
- go no further than necessary to demonstrate the vulnerability
- do not exfiltrate, modify or delete data, and do not maintain access once the issue is demonstrated
- do not degrade the availability of our services
- only use accounts, instances and devices that are yours or were given to you for testing
- do not use social engineering or physical intrusion
- keep the finding confidential until the agreed disclosure date
- stop and report immediately if you encounter personal data of others
This safe harbour binds TECHDOCK GmbH only. It cannot bind third parties or public authorities, and it does not cover actions outside these rules.
Changes to this policy
The current version of this policy is always published at this address. The machine-readable file at /.well-known/security.txt states when it should be reviewed.