White Hat Heroes

We welcome any reports of vulnerabilities in our systems sent to us in accordance with the guidelines below, whether from members of the THWS or from external parties. Vulnerabilities can never be entirely avoided.

Your feedback helps us to achieve the objectives set out in the Information Security Policy (https://informationssicherheit.thws.de/informationssicherheit/leitlinie), to make our systems and services more secure, and to protect our THWS members, their data, and their work from harm.

If you have found a vulnerability in our systems or services, please contact us via the email address security[at]thws.de

Please note the following guidelines on responsible disclosure:

Unfortunately, as a public institution, we are unable to offer a bug bounty or similar financial incentives.
If you adhere to the guidelines below, we may include your name and a link to your profile on our website.

Regulations:

• The report must be the first we receive regarding the specific vulnerability in our systems.
• The vulnerability described in your report is verifiable by us and its existence can be confirmed by us.
• Exploitation of the vulnerability described in your report would pose a verifiable threat to the confidentiality, availability or integrity of data, services, and systems.
• Please include the following information with your report:
• a description of the vulnerability
• where it can be found
• the conditions that must be met for it to be exploited
• its potential impact
• approaches to remedy the vulnerability

You must not:

• Exploit the security issue you have found.
• Infringe personal rights or compromise the confidentiality of data.
• Alter data and information belonging to THWS.
• Carry out social engineering attacks.
• Cause damage to our services, systems, networks, software applications, and user data.
• Restrict the use of our services, systems, applications, and infrastructure.
  This includes causing increased traffic, excessive port scans, or DoS/DDoS attacks.

If you adhere to these rules and we can assume that you have acted to the best of your knowledge and belief:

• We will not take legal action against you, nor will we ask the investigating authorities to take action against you.
• We will keep you informed of the progress made in rectifying the vulnerabilities
• If you expressly request it, we will treat your report as confidentially as possible.

THWS will decide independently, based on the criteria set out here, whether your report is suitable for inclusion in the list of reported issues. Unfortunately, pseudonyms cannot be accepted.

 

 

We welcome any information on vulnerabilities in our systems that are sent to us both by THWS members and external researchers in accordance with the regulations below. Vulnerabilities can never be completely avoided.

Your information on vulnerabilities will help us to achieve the goals set out in the Guideline for Information Security of the THWS (https://informationssicherheit.thws.de/informationssicherheit/guidelines-english), to make our systems and services more secure and to prevent damage to our university members, their data and their work.

If you have found a vulnerability in our systems or services, please contact us at security@thws.de

Please be aware of the following rules of responsible disclosure:
Unfortunately, as a public institution, we cannot offer a bug bounty or similar financial incentives. However, if you comply with the rules below, we may include your name and a link to your profile on our website.

Rules:

• The notification must be the first we receive of the specific vulnerability in our systems.
• The vulnerability described in your report is comprehensible to us and its existence can be confirmed by us
• Exploitation of the respective vulnerability from your report would entail a risk to the confidentiality, availability or integrity of data, services and systems that we can understand
• Please include in your report:
  • a description of the vulnerability
  • where it can be found
  • what conditions must be met for it to be exploited
  • its potential impact
  • approaches to eliminate the vulnerability

You must not:

• Exploit the security issue found yourself.
• Restrict personal rights or the confidentiality of data.
• Change THWS data and information.
• Carry out social engineering attacks.
• Cause damage to our services, systems, networks, software applications and user data.
• Restrict the use of our services, systems, applications and infrastructure. Not even by causing increased traffic, excessive port scanning or Dos / DDoS attacks.

If you comply with these rules and we can assume that you have acted in good faith:

• We will not take legal action against you, or reach out to investigating authorities to take action against you.
• We will keep you informed about the status of the remediation of the vulnerabilities.
• If requested by you, we will treat your report confidentially as far as possible.

THWS will decide independently whether your report is suitable for inclusion in the list of acknowledged reports. Unfortunately, pseudonyms cannot be included.