1. Purpose

We are committed to maintaining the security and integrity of our products, services, and systems. This policy provides guidelines for security researchers, ethical hackers and other stakeholders to report potential vulnerabilities responsibly.

2. Preferred contact mechanism

If you believe you have discovered a vulnerability in a Syntegon product or system please contact psirt@syntegon.live

3. Publication

In accordance with applicable law and our coordinated disclosure policy, we will provide security advisories to relevant stakeholders and, where appropriate, issue advisories after remediation without undue delay to protect customers.

4. Scope

This policy applies to:

• All accessible services and applications
• Syntegon products and solution
  
  

5. Responsible disclosure guidelines

Please act in good faith and consider the following restrictions. This is an incomplete list:

• Do not discuss the security vulnerability you have discovered with anyone other than the respective system owner and Syntegon during the coordinated disclosure process.
• Do not publicly disclose the vulnerability until the affected parties have been given enough time to remedy it, or until you have reached an agreement with all the parties including Syntegon.
• Communicate your intentions to Syntegon if you plan to disclose your findings publicly (advisory, conference talk, article, etc.)
• Once you have reported a vulnerability to Syntegon, do not repeatedly interact with the affected system during the coordinated disclosure process.
• Do not leverage vulnerabilities to download, modify or delete any data beyond the minimum necessary actions to provide a proof of concept
• Do not attempt to elevate privileges, or explore a system beyond the minimum necessary to provide a proof of concept
• Do not exfiltrate other users data
• Do not attempt to gain access to a system using brute force or social engineering techniques
• Do not use denial of service attacks
• Do not install malware or viruses

6. How to Report

Note:
You can choose to send your vulnerability reports anonymously to us. We will treat reports as confidential and will not share the personal data of the reporting parties or receiving organization without their respective consent. 

The vulnerability report should contain the following information:

• Title / Summary or brief description of the vulnerability
• A clear description of the vulnerability
• Affected systems or products

Optional: 

• Contact details
• Version information
• Impact
• Mitigation approach
• Severity
• Disclosure plans
• Time and date of discovery

7. Our Response

Upon receiving your report:

1. We will acknowledge receipt within 5 business days
2. We will assess and prioritize the vulnerability
3. We will keep you informed throughout the process
4. We will work toward a fix and coordinate disclosure without undue delay

8. Recognition

We value your contribution. If you report responsibly, we may publicly acknowledge your efforts (with your consent).

9. Safe Harbor

If you comply with this policy, we will not take legal action against you, and your activities will be regarded as good-faith security research.

10. Confidentiality 

All complaints and reports will of course be treated confidentially and can also be submitted anonymously. Confidential data may only be passed on if this is necessary and legally permissible. All managers are also obliged to forward reports received confidentially via the reporting channels described above.