We take vulnerability reports seriously and answer every one of them. This page explains how to reach us, what is in scope, and what you can expect.
Reporting a vulnerability
security@gucoia.de
Please include:
- the affected system, URL, or endpoint
- a description of the vulnerability and its potential impact
- reproduction steps we can follow
- your preferred language (German or English)
If you would like to encrypt your report, ask us for our public key first.
Machine-readable contact: /.well-known/security.txt, per RFC 9116.
Scope
In scope
gucoia.deand all its pageserp.gucoia.de(the ERPNext instance behind the form proxy)- publicly reachable endpoints under
/erp-api/
Out of scope
- third-party services we merely embed (for example our analytics provider)
- findings without demonstrable security impact — missing headers on static pages, version fingerprinting results, or best-practice recommendations with no concrete attack scenario
- social engineering against staff, physical attacks, spam or mail-bombing
What we ask you not to do
Please do not run tests that endanger service availability or other people’s data: no denial-of-service or load testing, no exploitation beyond the minimum needed to demonstrate the issue, and no access to, modification of, or disclosure of data belonging to others. If you encounter personal data by accident, stop testing and tell us in the report.
Response times
3 business days Acknowledgement of receipt
10 business days Initial assessment (severity, validity)
14 days Status updates during remediation
We ask for 90 days before public disclosure. If the issue is fixed sooner, earlier disclosure is fine — please coordinate the timing with us.
Our commitment
If you follow this policy, act in good faith, and report your findings confidentially, we will not pursue legal action against you. We treat such reports as a contribution to the security of our customers.
We will credit you by name once the issue is resolved, if you want us to. We do not currently run a paid bug bounty programme.
Vulnerabilities in customer deployments
If you run GuCoIA on your own infrastructure and suspect a vulnerability there, report it to security@gucoia.de as well. Please test only your own instance.