Last updated: 29.10.2026

PORTER GmbH takes the security of its products and services seriously. This policy provides a channel for reporting security vulnerabilities. It does not authorize security testing of our products, services, backend APIs, websites or IT infrastructure.

 

Scope

 

This policy applies to security vulnerabilities affecting:

• PORTER Desktop and associated services and components, including backend APIs
• Other software products and components developed, distributed or maintained by PORTER GmbH

Systems, installations and data of third parties, including those of our customers, hosting providers and cloud providers, are outside the scope of this policy.

How to report a vulnerabilityy

 

Please report security vulnerabilities to:

[email protected]

Our security contact information is also available at:

https://www.porter.de/.well-known/security.txt

 

Please include, where available:

• Affected product, component and version
• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Proof of concept, screenshots or logs

Responsible handling of information

 

Please do not:

• access, copy, modify or delete data that does not belong to you
• access accounts or systems belonging to other users or customers
• use credentials, keys or tokens that you discover
• perform social engineering, phishing, brute-force or denial-of-service attacks
• install malware, backdoors or persistent access
• disrupt or degrade the availability of our products or services

If you encounter personal data, confidential information, credentials or other sensitive information, stop your investigation and notify us. Do not disclose such information to third parties.

PORTER GmbH will assess reported vulnerabilities and, where necessary, take appropriate remediation or mitigation measures.

 

How we handle reports

 

We assess incoming vulnerability reports and, where appropriate, take measures to remediate or mitigate confirmed vulnerabilities.

We may contact you for additional information if you provide contact details.

We treat vulnerability reports confidentially to the extent permitted by applicable law. Information may be shared where necessary to investigate or remediate the vulnerability or where disclosure is required by law.

 

Coordinated disclosure

 

Please do not publicly disclose details of a potential vulnerability before we have had a reasonable opportunity to investigate and, where necessary, remediate or mitigate the issue.

Where appropriate, we will coordinate the disclosure of a confirmed vulnerability with the reporting party.

Where required by applicable law, PORTER GmbH will publish information about remediated vulnerabilities and make required notifications to the competent authorities.

 

End of process

 

The vulnerability handling process is considered complete when one of the following applies:

• The report is assessed as not valid.
• The vulnerability has been fixed or mitigated and, where appropriate, disclosed.
• We cannot continue the investigation because necessary information is missing and no response is received within 30 days.
• The issue has been coordinated with the responsible CSIRT and no further action is currently possible.