Vulnerability reports

Report privately

Please send vulnerability reports to [email protected].

Subject: [VULEN-SICHERHEIT] Product – Version – Brief description

For the website, use “Website – vulen.net” instead of product and version.

Include the affected address or product, version if known, reproducible steps, possible impact and a contact for follow-up. Please do not publish the report before we have investigated and coordinated with you. Do not send passwords, access keys, unredacted backups or third-party data.

Handling reports

The owner checks the inbox and coordinates investigation with development. Reports are assessed and prioritised by urgency. Where contact is possible, we discuss questions and next steps with the reporter. No fixed response or remediation times are promised.

The subject helps route reports. We also use AI-assisted development tools (Anthropic PBC, OpenAI). We remove personal information first and share only technical details. The owner handles this manually and does not pass on the reporter's name or email address.

Keep evidence to the minimum necessary. This policy does not grant general permission to examine other people's systems, bypass safeguards, access third-party data or disrupt services. Agree on a suitable channel with us before sending sensitive details.

Released applications

No VULEN applications are publicly released at the date of this notice. There is therefore no list of released apps or support end dates. We will add actual released products and confirmed support information before their first publication.