Policy on the Coordinated Disclosure of Security Vulnerabilities (CVD Policy)
Effective: August 24, 2026
1. Scope
This policy applies to products from SOFLEX Fertigungssteuerungs-GmbH. We take reports of security vulnerabilities seriously.
2. Point of Contact
Security vulnerabilities can be reported to:
E-Mail: security@soflex.de
Form: www.soflex.de/kontakt
A machine-readable version of this contact information is available at www.soflex.de/security.
3. What We Expect from a Report
Please provide us with the following information, to the extent possible:
- Affected product/system and version
- Description of the vulnerability and its potential impact
- Steps to reproduce the issue (if available)
4. Our Process
Step / Deadline
Confirmation of receipt of the report / within 5 business days
Initial assessment/feedback / within 15 business days
Fix or mitigation / depending on severity and complexity
Notification of affected parties after a fix / promptly after a security update becomes available
5. Coordinated Disclosure
We ask that you not disclose details of a reported vulnerability publicly before a fix or mitigation measure is available. We are happy to coordinate a publication date by mutual agreement.
6. Safe Harbor Commitment
Anyone who reports a vulnerability in good faith, within the scope of this policy, and without intent to cause harm need not fear legal action from us. This does not apply to actions that go beyond what is necessary to demonstrate the vulnerability (e.g., accessing or modifying third-party data, disrupting operations).
7. Language
Reports may be submitted in German or English.
This policy is reviewed regularly and updated as needed.