The security of our products and services is important to us. If you discover a potential security vulnerability in a Doxis product or service, we encourage you to report it to us responsibly.
Report a Vulnerability
Please use our security reporting form: Report security vulnerabilities
Please provide as much relevant information as possible, including the affected product and version, a description of the vulnerability, steps to reproduce it, potential impact, and any available technical evidence. Reports may be submitted in English or German.
Our Process
We acknowledge reported security vulnerabilities and appropriately investigate every security report we receive.
We identify potentially affected products and versions, assess severity, exploitability, and impact, and coordinate appropriate remediation or mitigation measures.
Reports indicating possible active exploitation or a significant security incident are prioritized for assessment. Where appropriate, we will inform the reporter about relevant validation results and remediation progress.
Please note that we do not offer a bug bounty program and hence please do not expect anything of that nature.
Coordinated Disclosure
Please allow Doxis reasonable time to investigate and address a reported vulnerability before publicly disclosing technical details.
The timing of disclosure may depend on factors such as severity, known active exploitation, the availability of mitigations or updates, and the potential impact on customers.
Responsible Security Research
Please avoid accessing data that does not belong to you, disrupting systems or services, performing denial-of-service testing, using social engineering, or exploiting a vulnerability beyond what is necessary to demonstrate its existence.
If you unintentionally access personal, confidential, or otherwise sensitive information, please stop testing and notify us immediately.
Safe Harbor
Doxis supports good-faith security research conducted in accordance with this policy.
If you act in good faith, avoid unnecessary harm, and comply with the rules described in this policy, Doxis will not initiate legal action solely because of your security research.
This commitment does not apply to actions that intentionally cause harm, involve unauthorized access beyond what is necessary to verify the vulnerability, or infringe the rights of third parties. This policy does not authorize access to third-party systems or data and does not affect any rights of third parties.
Security Advisories
For relevant security issues, Doxis may publish Security Advisories and, where appropriate, directly inform affected customers.
The publication of a Security Advisory does not necessarily mean that the vulnerability is subject to regulatory reporting requirements.
Where appropriate and with the reporter's consent, Doxis may acknowledge the reporter's contribution in a published Security Advisory.
No Special Requirements for Reporting
Reporting a vulnerability does not require a customer relationship, non-disclosure agreement, or other contractual obligation.