Reporting Security Vulnerabilities Responsibly
The security of our systems and the protection of the data we process are important to us. If you discover a potential security vulnerability in our services, we ask that you report it to us responsibly and confidentially.
Contact
Please send your report to:
Email: security@STV Electronic.de
Please use a descriptive subject line, such as “Security Alert: [brief description].”
Scope of Application
This policy applies to the publicly accessible websites and services operated by STV Electronic GmbH, in particular:
- https://www.stv-electronic.de
This does not include systems and services that are clearly operated by independent third-party providers. Please report vulnerabilities in such systems directly to the respective provider.
Content of a Report
To help us understand and investigate the vulnerability, your report should include the following information, if possible:
- Affected URL, application, or system component,
- Nature and potential impact of the vulnerability,
- reproducible steps for replication,
- if applicable, a brief explanation or sample code,
- web browser used, operating system, or other relevant technical information,
- Your contact information, if you would like us to get back to you.
Please do not transmit any personal data or confidential information unless it is absolutely necessary for the review. If you accidentally access such data, please stop accessing it and notify us.
Rules for Safety Inspections
Please keep the following guidelines in mind during your examination:
- Access data only to the extent necessary to demonstrate the vulnerability.
- Do not modify, delete, copy, or publish data belonging to others.
- Do not compromise the availability or stability of our systems.
- Do not perform denial-of-service or load tests.
- Do not use social engineering, phishing, or deception against employees, customers, or partners.
- Do not install any malware, and do not set up permanent access.
- Do not exploit identified vulnerabilities for your own purposes or those of others.
- Please notify us confidentially before disclosing any details to third parties or making them public.
This policy does not constitute a general authorization for any security tests. Only non-invasive tests that comply with the rules set forth above and applicable legal provisions are permitted.
How We Handle Reports
We will:
- confirm receipt of your report within 5 business days, if possible,
- review the report and assess its severity,
- Keep you informed of significant progress whenever possible,
- work with you to ensure appropriate and coordinated disclosure.
Depending on the complexity, impact, and service providers involved, the resolution may take varying amounts of time. We cannot guarantee a specific processing or resolution timeframe in every case.
Confidentiality and Disclosure
Please treat any information regarding a reported vulnerability as confidential for the time being. Disclosure should only take place after consulting with us and once a fix or an appropriate protective measure is available.
We will treat your contact information and the information you provide as confidential and use it to review and process the security report. Any statutory retention or disclosure requirements remain unaffected.
Compensation and Recognition
Reporting a vulnerability does not entitle you to a reward. We do not currently offer a bug bounty program.
Abuse and Other Reports
This contact address is intended exclusively for specific technical security reports. General support requests, spam, automated scan reports without verifiable security findings, and extortion demands will not be processed through this channel.
Thank you very much for helping us protect our systems and our users’ data.
As of: [08/2026]