Report a security vulnerability

Have you found a vulnerability in Symiko? Then we want to hear about it – before anyone exploits it. This policy describes how to report vulnerabilities to us, what you can expect from us and under which conditions we will not pursue your security research.

It covers the website and web app at symiko.de and their interfaces as well as the Symiko apps for iOS and Android, the time clock and the screen player. Services of other providers that we use (such as hosting, database or email delivery) are not covered; please report vulnerabilities there to the provider concerned.

Please write to hello@symiko.de with the subject “Security”. The contact details are also available in machine-readable form at /.well-known/security.txt.

We do not currently offer a dedicated encrypted channel (such as PGP). Please therefore do not send personal data of third parties, passwords or keys – a description of how to reproduce the finding is enough. If you need a secure way to share further material, we will agree one with you.

• a description of the vulnerability and its possible impact,
• the steps to reproduce it (ideally with a sample request or proof of concept),
• the affected address (URL) or interface, and for apps the platform, app version and device,
• when you tested and how we can reach you with questions.

• We acknowledge receipt of your report within three working days.
• We review the report, share our assessment with you and keep you informed about the fix.
• We fix confirmed vulnerabilities as quickly as possible, prioritised by severity.
• We agree the timing of any publication with you. If you wish, we will credit you as the finder.
• We do not currently pay rewards (bug bounty).

If you act in good faith and follow the rules below, we will not take legal action against you, will not file a criminal complaint and will not request prosecution:

• You only access data to the extent necessary to demonstrate the vulnerability. You do not modify, copy or delete other people’s data. If you come across personal data, you stop, keep none of it and inform us immediately.
• You do not disrupt our services: no load or denial-of-service tests, no mass automated requests and no mass emails, for example through our forms.
• You do not use social engineering (such as phishing or phone calls), do not attack premises or devices and do not target our customers, their employees or our service providers.
• You only use your own test accounts, never other people’s. Symiko has no open sign-up – if you need a test account, write to us.
• You report the vulnerability promptly and only to us.
• You keep the vulnerability confidential until it is fixed or we have agreed a publication with you, and you do not attach any demands to your report.

This commitment is given by Symiko. We cannot speak for the rights of third parties – such as our customers or service providers; should a third party take action against you, we will, on request, make clear that you acted within this policy.

We distribute security updates for our apps exclusively through Apple’s App Store and Google Play. Please install updates promptly, ideally with automatic updates enabled. We update the web app at symiko.de ourselves; you do not need to do anything there.

Where required by law, we report actively exploited vulnerabilities and severe security incidents to the competent bodies – for example under the Cyber Resilience Act (Regulation (EU) 2024/2847) via ENISA’s single reporting platform. If an incident involves personal data, we inform our customers as controllers without undue delay so that they can meet their own notification obligations (Article 33 GDPR).

Email: hello@symiko.de
Languages: German and English

Please report illegal content through our reporting form. Our postal address is in the legal notice.