Discovered a security vulnerability? Report it to us!

Policy for responsible disclosure of information security vulnerabilities

We would be grateful if you could help us to better protect our customers and our systems. We therefore ask you to inform us immediately if you discover a vulnerability. This will enable us to take the necessary steps to rectify it.


Please proceed as follows:

• Email your findings to cert@crossbase.de. Encrypt your findings with our PGP key (see below) to prevent this critical information from falling into the wrong hands.
• Do not exploit the vulnerability or issue you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability, or by deleting or modifying other people's data.
• Do not share the problem with others until it is fixed.
• Do not carry out physical security attacks, social engineering, distributed denial of service, spam or attacks on third-party applications.
• Provide sufficient information to reproduce the problem so that we can fix it as quickly as possible. Usually the IP address or URL of the affected system and a description of the vulnerability are sufficient, but complex vulnerabilities may require further explanation.

Our promise:

• Feedback
  We will respond to your message within 7 business days with our assessment of the message and an expected resolution date.
• Transparency
  We will keep you informed of progress in resolving the issue.
• Acknowledgment
  In the public information about the reported issue, we will mention your name as the discoverer of the issue (unless you request otherwise).
• Recognition
  As a token of our gratitude for your help, we offer a reward for every message about a security problem that we were not aware of. The amount of the reward depends on the severity of the leak and the quality of the report. The minimum reward is a €50 voucher.

We aim to resolve all issues as quickly as possible and will actively contribute to the publication once the issue has been resolved.