Report a vulnerability
Coordinated vulnerability disclosure policy. We thank everyone who helps us make Firnkern more secure.
Contact
Email: security@firnkern.com
Post: Firnkern GmbH i. Gr., Bosenhaldenweg 26, 4125 Riehen, Switzerland
Languages: German or English
We do not yet have a public key for encrypted email (PGP). Please do not include sensitive details in your first message – we will agree a secure channel with you.
Scope
This policy applies to all versions of:
- Firnkern Server (the software, including the cloud package),
- the Windows installer,
- the website firnkern.com.
Services of other providers, such as AI providers or data centres, are not covered. Please report issues there to the respective provider.
What to include in your report
- affected product and version (for example Firnkern Server 2.35) or the affected address,
- description of the vulnerability and its possible impact,
- steps to reproduce, with an example or screenshot if available,
- how we can reach you and whether you would like to be named.
How we proceed
| Step | Target |
|---|---|
| Acknowledgement of receipt | within 5 working days |
| Initial assessment (confirmed, severity, next steps) | within 10 working days |
| Fix | as quickly as possible; we keep you informed of progress |
| Coordinated publication | after the fix, as a guideline 90 days after the report – timing agreed with you |
Targets are not guarantees. Working days: Monday to Friday, excluding public holidays at Firnkern's registered office.
We list fixed vulnerabilities in the notes for the new version. Security updates are free of charge for customers.
Acknowledgement
If you wish, we name you – by name or pseudonym – when we publish. There is no bug bounty programme; we do not pay for reports.
Acting in good faith
We will not take legal action against anyone who searches and reports in good faith under this policy. Please follow these rules:
- Do not access more data than necessary to demonstrate the vulnerability. Do not copy, change or delete data.
- Do not disrupt operations (no load tests, no denial of service, no spam, no social engineering).
- Do not access third-party data. Test only your own or test installations – for example the trial version with the pilot and its fictitious data.
- No extortion: do not make your report conditional on demands.
- Publish details only after agreeing with us.
This commitment applies to Firnkern only. It cannot limit the rights of third parties (for example a customer whose installation you test).
Machine-readable
Contact and policy are also listed in /.well-known/security.txt (RFC 9116).
As of 3 November 2026 · applies to all versions of Firnkern Server, installer and website · Back to Security