Report a security vulnerability.

The security of our products, systems and customers is important to us. If you discover a potential security vulnerability in a BRUMBERG digital product or a related service, please inform us in confidence.

We support the coordinated disclosure of security vulnerabilities – Coordinated Vulnerability Disclosure (CVD). We take reports from security researchers, customers, partners, integrators and users seriously and investigate them thoroughly.

Please report security vulnerabilities by email to:

cra@brumberg.com

Please use this address exclusively for security-related reports. For general product enquiries, technical support, returns or other matters, please use our general contact form.

Scope

This policy applies to security vulnerabilities in:

• BRUMBERG products containing digital elements;
• BRUMBERG software, firmware and mobile applications;
• cloud-based services, insofar as they are necessary for the intended operation of a BRUMBERG product;
• communication, control and interface systems that form part of a BRUMBERG product;
• digital components that are integrated into a BRUMBERG product or are required for its operation.

If you are unsure whether a report falls within the scope of this policy, please report it anyway. We will assess our responsibility and, where appropriate, inform you of the next steps.

This policy is not the correct channel for:

• general product or operational enquiries;
• technical faults not related to safety;
• complaints, returns or warranty enquiries;
• security vulnerabilities in entirely independent third-party products or services.

However, if a third-party component affects a BRUMBERG product or its security, you may still submit the report to us. We will investigate the matter and, if necessary, liaise with the relevant manufacturer or service provider.

How to report a security vulnerability

Please send your report to:

Email: cra@brumberg.com

Where possible, please use a descriptive subject line, for example:

Security vulnerability report – [product name] – [brief description]

Where possible, your report should include the following details:

• Product name and, if known, item or model number;
• Hardware, software, firmware or app version;
• Affected interface, function or component;
• Description of the security vulnerability;
• Possible consequences;
• Steps to reproduce the issue;
• Proof of concept, if available;
• Information on whether the vulnerability is already being actively exploited or is suspected of being exploited;
• where applicable, log files, screenshots or other technical evidence;
• Your contact details in case we need to get in touch.

Please only send information that is necessary for the technical assessment. Please do not send any passwords, private keys, complete customer data or other confidential information unless absolutely necessary. If the secure transfer of confidential files is required, we will arrange a secure transfer method with you.

Rules for security testing

When carrying out a security test, please observe the following rules:

• Only test products, systems and accounts that you are authorised to test.
• Carry out tests only to the extent necessary to confirm the security vulnerability.
• Do not access other people’s data, and do not alter, copy or delete any data.
• Do not cause any disruption, overload or other impairment to products, services or business processes.
• Do not carry out tests on production systems if disruption cannot be ruled out.
• Do not install malware or make any permanent changes to systems.
• Stop the test as soon as you gain access to confidential data or if disruption cannot be ruled out, and inform us immediately.
• Do not publish details of the security vulnerability before the investigation and consultation with BRUMBERG have been completed.

This policy does not constitute general permission to carry out tests on third-party systems. Legal requirements, contractual agreements and the rights of third parties remain unaffected.

Our handling process

Upon receipt of a valid report, BRUMBERG endeavours to follow the procedure below:

Confirmation of receipt

We aim to confirm receipt of your report within two working days.

Initial assessment

We aim to provide an initial technical assessment or an interim update on the progress of the case within seven calendar days.

Investigation and rectification

We investigate the report, assess the risk and – where necessary – coordinate further steps with the relevant internal or external partners. The duration of the investigation and rectification depends, amongst other things, on the technical complexity, the severity of the vulnerability, the affected product version and the availability of suitable countermeasures.

In the case of confirmed security vulnerabilities, we consider appropriate measures. Depending on the circumstances, these may include security updates, firmware or software fixes, configuration guidance, workarounds or further protective measures.

We will inform the person who reported the issue of any significant progress, insofar as this is appropriate and provided there are no security, data protection, confidentiality or other legal reasons preventing this.

The timeframes mentioned are target service times. They do not replace statutory deadlines and do not limit statutory obligations.

Coordinated Disclosure

We ask reporters to treat the security vulnerability as confidential whilst it is being investigated and until suitable measures have been agreed.

Where public disclosure is appropriate or necessary, we will, where possible, coordinate the content and timing of the publication with the reporter. In doing so, we will take particular account of the availability of a fix or protective measure, as well as the risk of further exploitation.

Safe harbour for responsible security research

BRUMBERG does not intend to take legal action against individuals who conduct security research:

• in good faith;
• within the scope of this policy;
• solely for the purpose of identifying and confidentially reporting a potential security vulnerability;
• without accessing, altering, deleting or disclosing third-party data;
• without compromising the availability or security of systems;
• and in accordance with applicable law

.

This safe harbour notice does not apply to actions that intentionally cause damage, go beyond the scope necessary for the assessment, infringe the rights of third parties or contravene applicable law. It does not confer any rights vis-à-vis third parties and does not limit any legal obligations or measures taken by competent authorities.

Notice regarding the Cyber Resilience Act

This website is BRUMBERG’s public channel for reporting potential security vulnerabilities. Reporting via this website does not replace any statutory reporting obligations under the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847.

If BRUMBERG becomes aware of an actively exploited vulnerability or a serious security incident affecting the security of a product containing digital elements, additional reports may be required to the relevant authorities via the designated CRA reporting platform. The CRA reporting obligations apply from 11 September 2026. The remaining key CRA requirements generally apply from 11 December 2027.

Public notification to BRUMBERG and the statutory CRA notification are two separate processes. BRUMBERG carries out the statutory assessment and notification internally.

Data protection

We process any personal data you provide as part of a security report solely for the purposes of receiving, investigating, processing and following up on your report, as well as for communicating with you.

Further information on the processing of personal data can be found in our privacy policy.