Principles
The overriding goal of every report is to protect those affected and the adherence to hacker ethics. The same principles therefore apply in both directions:
- Avoid harm: We exploit vulnerabilities only as far as necessary to prove them. We do not exfiltrate data, modify anything or impair availability.
- Confidentiality: Details remain between the parties involved until the issue is fixed or the agreed deadline expires.
- Partnership: We work with vendors and reporters as equals, communicate transparently and keep our commitments.
- Proportionality: Deadlines and the scope of publication depend on risk, exploitation in the wild and willingness to cooperate.
- No payment as a condition: We never demand money or contracts in return for a report. A report is not a sales pitch.
Part A: Coordinated Disclosure of Our Own Findings
If Mint Secure discovers a vulnerability in a third party’s systems, we will notify the responsible party confidentially and publish details only after the issue has been resolved, or no later than 90 days after the initial report.
Process
- Initial report (day 0): We contact the vendor or operator via its security.txt, PSIRT, bug bounty programme or a publicly listed security address. The report includes a description, affected versions, impact and a proof of concept.
- Acknowledgement: We ask for a response within 7 days. If none arrives, we try again through other channels.
- Remediation phase: We support analysis and verification of the fix and agree on a publication date.
- Publication (no later than day 90): Once a fix is available, we publish an advisory in coordination with the vendor, with a CVE where applicable.
- Grace period (up to 30 days): If a patch ships within the 90 days, we publish technical details only 30 days later so that users have time to update.
Deviations from the 90-day deadline
| Situation |
Approach |
| Active exploitation in the wild |
Shortened deadline of 7 days; earlier warning to those affected if needed |
| Vendor is demonstrably working on a fix but needs more time |
One-time extension of up to 14 days, longer in justified cases |
| Critical infrastructure, medical devices, complex supply chains |
Individually agreed deadline, involving the BSI if appropriate |
| No response after several contact attempts |
Escalation to BSI or CERT-Bund; publication after the 90 days expire |
| Vulnerability already publicly known |
Coordination with the vendor; deadline may no longer apply |
Content of publications
Advisories include affected products and versions, severity (CVSS), a communication timeline and remediation guidance. We publish working exploits only once a patch is widely available and the insight gained outweighs the risk. We never publish personal data that became visible during analysis.
Part B: Reporting Vulnerabilities to Mint Secure
Please report vulnerabilities in our systems to security@mint-secure.de, PGP-encrypted if you wish; the key is available in our security.txt at mint-secure.de/.well-known/security.txt.
What a report should contain
- Affected system, URL or component
- Type of vulnerability and potential impact
- Steps to reproduce or a proof of concept
- When you found it and your contact details (anonymous reports are welcome)
Our commitments
| Step |
Timeframe |
| Acknowledgement of receipt |
within 3 business days |
| Initial assessment and triage |
within 10 business days |
| Status updates |
at least every 14 days |
| Fix for critical and high-severity vulnerabilities |
targeted within 30 days |
| Fix for all other vulnerabilities |
within 90 days |
If remediation is delayed, we will tell you and explain why. We agree on any publication by you jointly; the 90-day deadline from your report applies here as well as a rule.
Safe Harbor and Rules of Engagement
Anyone who conducts research in good faith and follows these rules need not fear legal action from Mint Secure. We will not file criminal complaints or pursue civil claims. If third parties take action against you because of your research, we will make it known that you acted in accordance with this policy.
Permitted
- Testing your own accounts and data
- Demonstrating a vulnerability with minimal intrusion
- Low-intensity automated scanning
Not permitted
- Denial of service, load or stress testing
- Social engineering, phishing or physical access to our premises
- Accessing, copying, modifying or deleting other people’s data beyond what is needed for proof
- Installing backdoors or establishing persistence
- Attacking systems of our clients, partners or service providers
- Publishing before the fix or before the agreed deadline has expired
- Demanding payment as a condition for the report
If you accidentally come across personal or confidential data, stop testing, do not store anything and notify us immediately.
Scope
| In scope |
Out of scope |
| mint-secure.de including subdomains |
Systems and data of our clients |
| Publicly accessible services of Mint Secure GmbH |
Third-party platforms (e.g. hosting, SaaS) not operated by us |
| Software and tools published by Mint Secure |
Findings without security impact (e.g. missing headers without an exploit scenario) |
Confidentiality and Changes
Confidentiality and data protection: We treat reports confidentially and share your identity only with your consent, for example with an affected vendor. We process personal data solely to handle the report, based on Art. 6(1)(f) GDPR, and delete it once the case is closed.
Legal obligations: Statutory reporting obligations, for example under NIS2 or the Cyber Resilience Act, remain unaffected and take precedence over this policy.
Changes: We review this policy at least once a year. The version published at the time of the report applies.
The 90-day deadline follows established programmes such as Google Project Zero and the CERT/CC policy, as well as ISO/IEC 29147.
