In short: Please report security vulnerabilities in our products or on this website by email to info@aloaha.com, subject “Security”. We acknowledge receipt within two business days, assess the report, fix the vulnerability and agree on publication with you. We report actively exploited vulnerabilities to the authorities under the Cyber Resilience Act (Regulation (EU) 2024/2847). The machine-readable contact file is at /.well-known/security.txt.
Which products does this policy cover?
- Aloaha ZUGFeRD SDK (
Aloaha_ZUGFeRD.dll, also as a NuGet package) and the command-line tool zugcmd - Aloaha ZUGFeRD GUI and Convert2PDFA
- Aloaha ZUGFeRD PDF Viewer (PDF Editor)
- the installers and downloads of these products
- the website www.zugferdpro.com
We accept reports about other products of Aloaha Limited and CodeB at the same address.
How to report a vulnerability
Write to info@aloaha.com, in English or German. Helpful information:
- affected product and version (e.g. from the file properties of the DLL)
- a description of the vulnerability and its possible impact
- steps to reproduce, ideally with a sample file (invoice, PDF, XML)
- whether you know that the vulnerability is already being exploited
- how to reach you and whether you want to be credited by name
Please do not send real invoice or customer data. Anonymised sample files are sufficient.
What happens after your report
| Step | Time frame |
|---|---|
| Acknowledgement | within 2 business days |
| Initial assessment (severity, affected versions) | within 5 business days |
| Fix for critical vulnerabilities | target: within 7 days |
| Fix for high-severity vulnerabilities | target: within 30 days |
| Fix for medium or low severity | with one of the next updates, at the latest after 90 days |
We rate severity using the Common Vulnerability Scoring System (CVSS). We keep you informed about the progress and tell you if we cannot meet a time frame.
Reporting to authorities (Cyber Resilience Act)
If we learn that a vulnerability in one of our products is being actively exploited, or a severe security incident occurs, we report it via ENISA’s Single Reporting Platform to the competent CSIRT:
- early warning within 24 hours
- notification within 72 hours
- final report no later than 14 days after a fix is available (for severe incidents within one month)
We inform affected customers about the vulnerability and the fix.
Security updates
Security fixes are released for the current major version 11 and listed in the version history on the downloads page. With a valid maintenance contract the update is free.
Coordinated disclosure
Please publish details of a vulnerability only once a fix is available or by agreement with us, but no later than 90 days after your report. On request we credit you in the version history. We do not run a paid bug bounty programme.
Rules for security research
If you search for vulnerabilities in good faith and follow these rules, we will not take legal action against you:
- Test with your own installations and your own test data, not with other people’s systems or data.
- No attacks on availability (denial of service), no social engineering, no spam.
- Access only as much data as needed to demonstrate the issue, and delete it afterwards.
- Give us time to fix the issue before you publish details.
Frequently asked questions
How do I report a vulnerability in the Aloaha ZUGFeRD SDK?
By email to info@aloaha.com with the subject “Security”: affected version, description, steps to reproduce and, if possible, an anonymised sample file. We acknowledge receipt within two business days.
Is there a security.txt?
Yes, at https://www.zugferdpro.com/.well-known/security.txt according to RFC 9116. It lists the contact address and points to this policy.
How quickly are vulnerabilities fixed?
Critical vulnerabilities with a target of 7 days, high-severity ones within 30 days, all others at the latest after 90 days. We rate severity using CVSS.
Are vulnerabilities reported to authorities?
Yes. We report actively exploited vulnerabilities and severe security incidents under the Cyber Resilience Act via the ENISA reporting platform: early warning within 24 hours, notification within 72 hours, followed by a final report.
Is there a bug bounty programme?
No. On request we credit reporters in the version history.