Report vulnerability

In the event that you find a technical vulnerability in one of DUWO’s systems, you can report this to us. This kind of report is known as a Coordinated Vulnerability Disclosure or CVD.

Vulnerabilities that pose a risk to system security can be reported to us. Examples include vulnerabilities that enable login forms to be bypassed or provide unauthorised access to databases containing personal information.

Please take the following steps:

• Send a message to [email protected] and tell us what you have found.
• In your report, please describe as clearly as possible how the problem can be reproduced as this will help to accelerate the resolution process. Usually, the IP address or the URL of the affected system and a description of the vulnerability will suffice, although for more complex vulnerabilities, additional information may be required. In such cases, we will contact you.
• At the very least, please provide an e-mail address or telephone number to enable us to contact you if we have any questions. We prefer to communicate via e-mail.

Ensure that you:

• Report the vulnerability as soon as possible after discovering it.
• Do not share any information about the security problem with others until you hear from us that it has been resolved.
• Handle the knowledge of the security problem responsibly, for example, by performing no further actions involving the defect other than those that are necessary to demonstrate the security problem.

What must you not do?

You must never perform the following actions:

• Introduce malware into the system.
• Copy, edit or delete data in the system.
• Make changes to the system.
• Repeatedly access the system or share access to the system with others.
• Perform brute-force attacks to gain access to a system.
• Perform denial-of-service attacks or social engineering.

• If you submit your report in accordance with the procedure, then there will be no grounds for legal consequences in relation to your report. We will handle your report in confidence and we will not share your personal details with third parties without your permission unless we are compelled to do so by law or by a court ruling.
• We will confirm receipt of the report within one week and we will subsequently send an assessment of your report within two weeks. We will also give you progress updates regarding the resolution of the problem.
• DUWO will strive to have the security problem identified by you resolved within no more than 60 days. Upon resolution of the problem, we will consult with you to determine whether and in what way to publish details of the problem and its resolution.