Reporting a vulnerability.

Write to contact@bunkersystems.com with "Security" in the subject. Include what you found, where, how to reproduce it, and what you think the impact is. English or German. Do not open a public issue, post it on a forum, or contact a third party before we have replied.

There is no bug-bounty programme. Reports are read by the person who can fix the problem.

In scope

bunkercorpo.com, bunkersystems.com, digitalxbunker.com, bunkerverse.com, the holding pages of the group's other brands, the Bunkersphere services, the Control Center client, and any software product the group publishes.

Out of scope

Denial of service, volumetric or resource-exhaustion testing; social engineering of any person; physical attacks; findings on third-party services we use (Cloudflare, Fab, Steam) — report those to that provider; automated-scanner output with no demonstrated impact.

• Acknowledge your report within five working days.
• Tell you what we found and, when the fix ships, that it has shipped.
• Credit you in the release note if you want to be credited, and not name you if you do not.
• Not take legal action against research done in good faith that stays within this scope, accesses no more data than needed to demonstrate the problem, and gives us reasonable time to fix it before any disclosure.

Personal data you send us in a report is processed to handle the report and for nothing else; see the privacy notice.