Reporting security vulnerabilities

Please report vulnerabilities in Floorstack MIA and in the services under floorstack.ai to security@floorstack.ai.

Please include: affected product and version, a description with steps to reproduce, the possible impact and how we can reach you. Please do not send customer data or credentials.

Machine readable per RFC 9116: /.well-known/security.txt

The mailbox is read by Julian Sikora, responsible for engineering at Floorstack. In his absence another managing director takes over. Reports are shared only with the people working on the fix.

We respond within 2 business days with an acknowledgement and a first assessment.

For critical vulnerabilities our target is a fix within 14 days of confirmation. For other vulnerabilities the timeline depends on severity. We keep you informed until the issue is resolved.

We report actively exploited vulnerabilities in Floorstack MIA under Art. 14 of Regulation (EU) 2024/2847 through the ENISA reporting platform to the competent CSIRT, in Germany the BSI: an early warning within 24 hours, a notification within 72 hours and a final report no later than 14 days after a fix is available.

We inform affected customers directly about the vulnerability and the measures they need to take.

Please publish details only once a fix is available, and no later than 90 days after your report. We agree on the date together. If you wish, we credit you in our security advisory.

When testing, please access only the data needed to demonstrate the issue, avoid service disruption and do not test against our customers’ systems. Social engineering and physical attacks are out of scope.