Cyber Security reporting

Trenz Electronic GmbH develops and manufactures high-quality FPGA modules, System-on-Modules, and customized electronic solutions. The security of our products is a key priority throughout their entire lifecycle.

Despite careful development, technical products may contain security vulnerabilities. We therefore welcome reports from security researchers, customers, users, and other individuals who identify potential vulnerabilities in our products, services, or infrastructure.

This page explains how security vulnerabilities can be reported to us and how we handle such reports. Our approach is based on the Coordinated Vulnerability Disclosure (CVD) model.

We kindly ask you to report potential vulnerabilities directly to us first and to refrain from publishing them until we have had the opportunity to analyze the issue and, where necessary, take appropriate measures to protect users.

The complete Coordinated Vulnerability Disclosure policy of Trenz Electronic GmbH is available as a PDF document. It describes the applicable principles and framework for reporting and coordinating the disclosure of security vulnerabilities.

Download CVD Policy

Download security.txt

How to report a vulnerability

The contact options listed below are available for reporting potential security vulnerabilities. They serve as the central points of contact at Trenz Electronic GmbH for reports and information concerning possible vulnerabilities in our products.

Web reporting form

A form is available at the end of this page where you can describe the identified issue in as much detail as possible. We recommend using this form for structured submission of your report.

Dedicated email

psirt@trenz-electronic.de

We respond to reports in German and English.  

What to include in the report

To help us understand, assess, and reproduce a reported issue as quickly as possible, your report should include the following information where available:

• The affected product, including product name or product code, hardware and/or firmware version, and serial number if available
• A detailed description of the vulnerability and its potential impact
• The required steps to reproduce the issue, for example a proof of concept, commands, requests, or configuration details
• Any prerequisites or conditions required to exploit the vulnerability
• Logs, screenshots, photos, files, or code that may assist with the analysis
• Your contact details for further communication if you would like to receive updates on the progress or be credited where applicable
• An indication of whether, to your knowledge, the vulnerability is already known or has already been disclosed, or whether third parties have already been informed, for example CVE authorities, CSIRTs, or other vendors
• An indication of whether you believe the vulnerability is currently being actively exploited

A complete exploit is not required for a report. A clear and sufficiently detailed description of the issue may already provide the information needed for our analysis.

Rules of conduct ("safe harbor")

Trenz Electronic GmbH considers security research conducted responsibly and in good faith to be a valuable contribution to improving the security of our products.

We will not initiate or support legal action against individuals who report a vulnerability in accordance with this policy, provided that the following principles are observed during the research and reporting process:

• This policy is followed and the research is conducted in good faith
• Violations of privacy, destruction or modification of data, as well as disruption or impairment of our services, are avoided
• Personal or confidential data belonging to third parties is not accessed, copied, or retained beyond the minimum necessary to demonstrate the vulnerability. Such data must be deleted once the reporting process has been completed
• The identified vulnerability is not exploited beyond what is necessary to verify its existence. This includes, in particular, data exfiltration, lateral movement within systems, or the installation of malware
• The vulnerability is not publicly disclosed before it has been addressed and a timeline for possible disclosure has been agreed with us
• All applicable laws and regulations are complied with

The “Safe Harbor” does not apply to activities that intentionally cause damage, involve extortion, include unnecessary access to data, or are otherwise unlawful.

If you are unsure whether a planned investigation complies with these requirements, please contact us in advance. We can coordinate the next steps together.

Public disclosure

We follow a coordinated disclosure approach. Details of a vulnerability should therefore generally only be published once an appropriate fix or mitigation is available to users and the disclosure has been coordinated with the reporting individual.

As a general guideline, we allow a period of 90 days from receipt of a report to make an appropriate fix available. In more complex cases, this period may be extended by mutual agreement.

Where appropriate, we may publish a Security Advisory on our website.

Acknowledgements

Unless you request otherwise, we would like to publicly acknowledge individuals whose reports have contributed to improving the security of our products. Your name or a pseudonym of your choice may be mentioned in the relevant Security Advisory.

If you prefer to remain anonymous, we will of course respect your decision.

At present, we do not operate a financial reward or bug bounty program.

Scope

This policy applies to products with digital elements manufactured by Trenz Electronic GmbH, as well as to services and infrastructure directly operated or managed by Trenz Electronic GmbH.

If a reported vulnerability affects a customer product that integrates components from Trenz Electronic, or a third-party component included in one of our products, you may still contact us. In such cases, we will coordinate the further handling of the issue with the responsible party.

Web reporting form