Vulnerability Disclosure Policy

Version 1.0, last updated: 2026-10-13

Roomle takes the security of its products and services seriously. If you found a security vulnerability, we want to hear about it. This policy explains how to report a vulnerability to us, what we ask from you and what you can expect from us.

Scope

This policy covers all products and services that Roomle develops and operates, in particular:

The following is not in scope:

  • websites, shops and systems of our customers, even if they embed the Rubens Configurator. Please report such issues to the respective company.
  • denial of service attacks and load tests
  • social engineering, phishing or physical attacks against Roomle employees or offices
  • reports from automated scanners without a proof of an actual vulnerability
  • missing best practices without a demonstrated security impact, for example missing security headers alone

How to report

Please send your report to security@roomle.com. Please do not use our support desk or social media for security reports. You can write to us in English or German.

Please include:

  • a description of the vulnerability and its possible impact
  • the affected product, URL or package version
  • the steps to reproduce it, ideally with a proof of concept
  • your contact information, if you want us to stay in touch with you

What we ask from you

  • Only access or change data that is necessary to prove the vulnerability. Do not download, keep or share data of our customers or their users.
  • If you get access to personal data or data of our customers by accident, stop and report it to us immediately.
  • Do not disrupt our services or the services of our customers.
  • Do not publish the vulnerability before we agree on a publication date with you.

What you can expect from us

  • We confirm your report within 5 working days.
  • We give you a first assessment within 10 working days.
  • We keep you informed about our progress.
  • We fix confirmed vulnerabilities as fast as possible, depending on their severity.
  • We agree with you on the time of publication. Our standard period for coordinated disclosure is 90 days after your report. If a fix needs more time, we will talk with you about it.
  • If you want, we can name you in our security advisory as the person who found the vulnerability.
  • We treat your personal data confidentially and do not share it with third parties without your consent. See also our privacy statement.

We do not offer a bug bounty program at the moment.

Safe harbour

If you act in good faith and follow this policy, we will not take legal action against you because of your research, and we will not ask authorities to do so. This does not affect our legal obligations to report vulnerabilities or incidents to the competent authorities.

Changes to this policy

We may update this policy. The current version is always published on this page.

Contact

security@roomle.com

security.txt: https://www.roomle.com/.well-known/security.txt.