Coordinated Vulnerability Disclosure Policy

1. Purpose

Mitkov Systems GmbH designs, develops and operates connected measurement products and the IoT Center platform. We take the security of these products seriously and we recognise that, despite our efforts, vulnerabilities will occasionally exist in our software, firmware and services.

This policy describes how to report a suspected vulnerability to us, what you can expect from us in return, and the terms under which we ask researchers to work with us. It applies to everyone — customers, partners, independent security researchers and members of the public.

We follow the principles of coordinated vulnerability disclosure as described in ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling processes).

2. Scope

2.1 In scope

This policy covers:

• The IoT Center platform — the web application, its APIs, and the supporting services operated at iot-center.de and its subdomains.
• The MQTT broker infrastructure operated by Mitkov Systems for the ingestion of device telemetry and the dispatch of device commands.
• Device firmware for measurement products manufactured by Mitkov Systems, for all firmware versions within their published support period.
• Client libraries, SDKs and integration components published by Mitkov Systems.
• Update and provisioning infrastructure, including firmware image distribution and device credential issuance.

2.2 Out of scope

The following are not covered by this policy:

• Systems and services operated by our customers, including customer-hosted MQTT brokers, customer network infrastructure, and devices that have been modified from their shipped configuration.
• Third-party services we use but do not operate (for example, cloud infrastructure providers, payment processors, or email delivery services). Please report issues in those services to their respective operators; we are glad to help coordinate.
• Our corporate website and marketing pages, except where a finding demonstrates access to customer or device data.
• Products that have passed the end of their published support period, except where the finding also affects a supported product or our operated services.

2.3 Findings we generally do not act on

We welcome all reports, but the following are unlikely to be treated as vulnerabilities in their own right unless you can demonstrate concrete impact:

• Missing security headers with no demonstrated exploit.
• Reports produced solely by automated scanners, without validation.
• Self-XSS, clickjacking on pages without sensitive actions, or issues requiring an already-compromised device or browser.
• Absence of rate limiting on endpoints without an authentication or resource-exhaustion impact.
• Theoretical weaknesses in cryptographic configuration with no practical attack path.
• Social engineering of our staff or customers, and physical attacks against our offices.

3. How to report

Send your report to security@mitkov-systems.de.

We accept reports in English, German or Bulgarian.

3.1 Encryption

If your report contains exploit details, proof-of-concept code, or any customer data, please encrypt it. Our PGP key is published at:

https://www.mitkov-systems.de/.well-known/pgp-publickey.txt
Fingerprint: C24D A2B9 F77D 79E7 A343 5B80 F203 796F 23C7 E34C

We will reply in kind if you include your own public key.

3.2 What to include

The more of this you can provide, the faster we can act:

• A description of the vulnerability and the impact you believe it has.
• The affected product, service, URL, or firmware version.
• Step-by-step reproduction instructions.
• Any proof-of-concept code, request/response captures, or screenshots.
• Your assessment of severity, and a CVSS vector if you use one.
• Whether the issue is, to your knowledge, being actively exploited.
• How you would like to be credited, or that you prefer to remain anonymous.

3.3 Machine-readable contact

Our security contact information is also published in security.txt format, in accordance with RFC 9116, at:

• https://www.mitkov-systems.de/.well-known/security.txt

4. What you can expect from us

Remediation timelines for device firmware may be longer than for the IoT Center platform, because firmware releases require validation and because deployed devices are updated over constrained network links. Where a firmware fix cannot be delivered within the target window, we will tell you why, give you a revised date, and describe any mitigations available to customers in the meantime.

We will:

• Confirm whether we have reproduced the issue, and tell you if we have not.
• Tell you our severity assessment and the reasoning behind it.
• Keep you informed of our remediation progress.
• Tell you when a fix has been released.
• Credit you in our security advisory, unless you ask us not to.

We will not ask you to sign a non-disclosure agreement as a condition of engaging with us.

5. Disclosure

We ask that you give us 90 days from the date we acknowledge your report before disclosing the vulnerability publicly. We aim to publish an advisory and release a fix well within that window.

If we need more time — most often for firmware issues affecting deployed devices — we will ask you, explain why, and propose a specific date. We will not ask for an open-ended extension.

We will publish a security advisory for each confirmed vulnerability affecting a supported product, containing:

• A description of the issue and its impact.
• Affected product and version ranges.
• The fixed version and how to obtain it.
• Any workaround available to customers who cannot update immediately.
• A CVE identifier, where one has been assigned.
• Credit to the reporter.

Advisories are published at https://www.mitkov-systems.de/en/blog?tag=security%20advisory.

If we determine that a vulnerability is being actively exploited, we may disclose sooner than the agreed date in order to protect our customers. We will tell you before we do.

We ask that you do not disclose publicly before the agreed date, and that if we have not responded within 90 days despite your attempts to reach us, you consider it reasonable to proceed with disclosure.

6. Regulatory reporting

Products with digital elements placed on the EU market are subject to Regulation (EU) 2024/2847 (the Cyber Resilience Act). Where a reported vulnerability in one of our products is being actively exploited, or where an incident has a severe impact on the security of one of our products, we are required to notify the relevant Computer Security Incident Response Team and ENISA within statutory deadlines.

Such a notification is made to authorities and is separate from public disclosure. It does not shorten the coordination timeline described above, and it does not include your identity unless you ask us to name you.

7. Safe harbour

We will not initiate or support legal action against you, and we will treat your activity as authorised, provided that you:

• Act in good faith and comply with this policy.
• Stay within the scope defined in section 2.
• Make a good-faith effort to avoid privacy violations, service degradation, and destruction or modification of data belonging to us or our customers.
• Use only your own accounts and your own devices for testing, or accounts and devices you have explicit permission to test.
• Stop testing and report immediately if you encounter customer data, personal data, or credentials.
• Do not access, download, retain, or share any data beyond the minimum needed to demonstrate the vulnerability, and delete it once we confirm receipt.
• Do not perform denial-of-service testing, load testing, spam, or physical attacks.
• Do not attempt to pivot from a finding into our internal networks or those of our customers.
• Give us reasonable time to remediate before disclosing publicly.

Please note that we cannot grant safe harbour on behalf of our customers, our hosting providers, or any other third party. Testing against a customer's deployment requires that customer's permission.

If a third party brings legal action against you in respect of activity that complied with this policy, we will make it known that your activity was conducted in accordance with it.

8. Rewards

We do not currently operate a paid bug bounty programme.

We credit reporters in our published advisories, and we are glad to provide a written acknowledgement of your contribution on request.

9. Testing guidance

If you are testing our devices or the MQTT infrastructure, please note:

• Test against your own hardware. If you do not have a device and need one for research, contact us — we may be able to help.
• Do not send commands to devices you do not own. Our products control physical equipment, and a command sent to a production device can affect a live industrial or agricultural process.
• Do not attempt to exhaust broker resources or flood telemetry topics.

If your research requires an approach that this policy does not permit, write to us first. We would rather discuss it than have you self-censor a finding that matters.

10. Changes to this policy

We may update this policy from time to time. The current version is always available at https://www.mitkov-systems.de/en/coordinated-vulnerability-disclosure-policy. Material changes will be noted in the version history below.

11. Contact

security@mitkov-systems.de

Mitkov Systems GmbH
Sackgasse 4, D-64686 Lautertal
Amtsgericht Darmstadt/HRB 98592

For matters that are not security vulnerabilities, please use our general support channels at https://www.mitkov-systems.de/en/contacts.