To keep user data safe and ensure privacy is protected, XUND Solutions GmbH is looking forward to working with the security community to help identify vulnerabilities. If you’re a security researcher or ethical hacker and you’ve found a vulnerability in our products, please let us know by using the VDP form linked below.

Rules

When researching our systems, always act in good faith. You must use discovered vulnerabilities only for your own investigation. Keep the discovered vulnerability confidential until you have agreed upon when and how to disclose the vulnerability with XUND. We do not allow you to do security research on our systems and (online) applications that would materially adversely impact the performance or availability.

Please be advised, that currently, we do not offer any form of bounty for any findings. We are not planning on implementing a public bounty system anytime soon.

What vulnerability disclosure is not used for?

• Reporting complaints about XUND services
• Questions and complaints about the availability of XUND’s services
• Reporting fraud or presumption of fraud
• Reporting fake emails, spam or phishing emails
• Reporting malware

International Law

We would like to point out that this responsible disclosure policy is governed by Austrian law. If you are located in a different country, keep the applicable local law in mind, as other countries may have different laws regarding responsible disclosure. This could mean that you will be subject to local legal recourse or may be subject to agencies enforcing such different local law, even if XUND does not seek legal recourse or file a report at a law enforcement agency.