What you can report
- Security vulnerabilities in our products, e.g. MailCenter and InvoicePro
- Vulnerabilities on our website or in the download and customer area
- Abnormalities at our Peppol Access Point
- Suspicion of a personal data breach
- Phishing emails or other misuse of our name
- Other security-related information about munich enterprise software
What happens after your report
- Acknowledge receipt – We will confirm receipt of your report by email within two working days.
- Check and evaluate – We analyze the vulnerability, classify the risk and get back to you if you have any questions.
- Fix and inform – We close the gap and let you know as soon as it is fixed.
Report in good faith
Anyone who reports a vulnerability to us in good faith and adheres to the following principles does not have to fear legal action from us:
- They only access systems or data to the extent necessary to prove the vulnerability and do not modify or delete data.
- They do not interfere with any services – for example through load or denial-of-service tests – and do not use social engineering against our employees.
- They keep the vulnerability confidential until it is fixed and do not share it with third parties.
Please do not send us any access data or personal data of third parties. We will request attachments from you specifically if necessary. We do not currently offer a bug bounty program.
Report a vulnerability
Describe the vulnerability as specifically as possible – mandatory fields are marked with *. If the vulnerability is already being actively exploited, please indicate this in the form: We treat such cases with the highest priority. Write to security@munich-enterprise.com. You can also find our guideline in machine-readable form according to RFC 9116 at /.well-known/security.txt.
