1. Introduction

The CVD process at achelos covers reports of vulnerabilities and security incidents. The process consists of the following phases, which are described in more detail below: reporting, assessment and disclosure.

The process is loosely based on the “Leitlinie des BSI zum Coordinated Vulnerability Disclosure (CVD)-Prozess – Umgang des BSI mit Schwachstellenmeldungen”, version 1.0, dated 1 December 2022.

2. Reporting

Vulnerabilities and security incidents can be reported via a designated email address. Reports may optionally be encrypted using the achelos public key.

See: https://www.achelos.de/.well-known/security.txt

Reporters are responsible for ensuring that any security testing they conduct is lawful or has been carried out with the consent of achelos. achelos will not take legal action against reporters who act in good faith and in accordance with applicable German law and this policy.

Reports of vulnerabilities and security incidents should include the following information:

1. Report type (vulnerability or security incident)
2. Product name and version number
3. A general description of the vulnerability or security incident, including visual information where appropriate
4. A description of the steps required to reproduce the issue and, where applicable, a proof of concept (PoC) clearly demonstrating how the vulnerability can be exploited or how the security incident can be triggered
5. Optionally, a risk assessment, for example using a CVSS score and the associated input values, together with a description of the potential impact and its severity
6. Optionally, valid contact details, as additional information may be required, particularly in the case of complex vulnerabilities or security incidents

achelos does not operate a bug bounty programme and does not offer financial compensation for vulnerability or security incident reports. Reports should therefore not be submitted on the condition that financial compensation is provided.

Where appropriate and legally permissible, achelos may request a coordinated disclosure period of up to six months before details of a vulnerability are publicly disclosed. The actual disclosure period will depend on the nature and severity of the vulnerability and the time reasonably required to develop and deploy appropriate corrective measures.

3. Assessment

Incoming reports are reviewed and assessed internally. achelos reserves the right to process only reports that contain sufficient information to allow the reported issue to be understood and assessed.

As part of the assessment, achelos determines, among other things, whether the reported vulnerability or security incident is subject to mandatory reporting requirements, including those under the Cyber Resilience Act (CRA).

Following the assessment, the reporter will be informed of the outcome, provided that valid contact details have been supplied.

Where appropriate, achelos may initiate a coordinated vulnerability disclosure process regardless of whether the reported issue is subject to a statutory reporting obligation.

4. Disclosure

Where a reported issue constitutes an actively exploited vulnerability or a severe incident having an impact on the security of a product with digital elements and is subject to the reporting obligations under the Cyber Resilience Act, achelos will submit the required notifications in accordance with Article 14 of the CRA via the designated reporting mechanism.

Mandatory reporting under the CRA is separate from the coordinated public disclosure of vulnerability details.

achelos will coordinate any public disclosure with the relevant parties and will take into account the availability of appropriate corrective or mitigating measures, the risk to affected users and applicable legal requirements.

Where applicable, publicly known vulnerabilities may subsequently be included in the European vulnerability database in accordance with the applicable legal framework.