Report a vulnerability

Coordinated vulnerability disclosure policy. Last updated: 2026-10-08.

1. Purpose

At Frederich Engineering, security comes before speed and features. If you find a security vulnerability in one of our products or services, we want to hear about it so we can fix it quickly. This policy explains how to report, what you can expect from us, and the rules for your testing.

2. Scope

• Klarfeed Cloud (klarfeed.app) and the Klarfeed website (klarfeed.com)
• the Klarpass password generator (klarpass.app)
• Software by Frederich Engineering that we sell or publish (e.g. self-hosted Klarfeed), current version
• our company website frederich-engineering.com

Out of scope: third-party services we use (e.g. Stripe, Hetzner, our e-mail provider) -- please report to them directly -- and third-party feeds and websites shown in Klarfeed.

3. How to report

E-mail security@frederich-engineering.com, ideally with:

• the affected product or service and version or URL,
• a description of the issue and its impact,
• steps to reproduce (proof of concept),
• your name or handle if you would like to be credited.

English or German is fine. Please encrypt sensitive details with our PGP key (RSA 4096, valid until 2027-06-30), fingerprint:
2D28 1AA4 8156 6C99 B747 6DEB 7E91 8184 7FC9 FEFE

4. What you can expect from us

We are a small company and only promise what we can keep:

• Acknowledgement within 3 business days.
• Initial assessment (confirmed / not reproducible / not a security issue) within 10 business days.
• We keep you updated on the fix.
• Fix: critical issues as fast as possible, target for every confirmed issue 90 days at most.
• Disclosure: coordinated with you; by default after the fix, at the latest 90 days after your report, unless we agree otherwise. We credit you if you wish.
• Where appropriate, we request a CVE ID.
• We meet our legal reporting obligations, in particular under the EU Cyber Resilience Act.

We currently pay no rewards (no bug bounty).

5. Testing rules and our commitment

If you act in good faith and follow these rules, we will not file a criminal complaint or take civil action against you. We cannot speak for third parties (e.g. authorities), but on request we will confirm that your testing was within this policy.

• Test only with your own accounts and data. For Klarfeed Cloud you can ask us for a test account.
• Do not access other users' data. If you come across it anyway: stop, do not keep or share it, and tell us.
• No testing that degrades the service (denial of service, load tests, mass requests, spam).
• No social engineering, phishing or physical access; no attacks on our staff, contractors or hosting providers.
• Exploit an issue only as far as needed to demonstrate it; no backdoors, no persistent changes.
• Publish details only after coordinating with us (section 4).

6. What we usually do not treat as a vulnerability

• automated scanner reports without demonstrated impact
• missing security headers or cookie flags without a concrete attack
• self-XSS, clickjacking on pages without a security-relevant action
• SPF/DKIM/DMARC findings, banners and version disclosure
• denial of service by sheer volume
• attacks that require an already compromised device or physical access

When in doubt, report anyway.