Logo Customgento
de en

security

Reporting vulnerabilities

Security is never finished. If you have found a vulnerability in one of our products or systems, please tell us – we appreciate every report and treat it confidentially.

Contact

E-mail: info@customgento.com
Phone: +49 69 3487455 0

The machine-readable version of this contact information is available per RFC 9116 at /.well-known/security.txt.

Scope

This policy covers:

  • our Magento extensions and any other software we publish,
  • our own systems and services under customgento.com,
  • code we wrote in customer projects.

Our customers' shops and infrastructure are not in scope. If your finding concerns a customer system, please still report it to us – we will forward it to the operator rather than having you contact them yourself.

What we ask of you

  • Send us enough detail to reproduce the finding: affected version, URL or file, steps, ideally a proof of concept.
  • Keep testing to the minimum necessary. No denial of service, no spam, no social engineering, no physical attacks.
  • Do not access other people's data and do not modify or delete anything. If you come across personal data by accident, stop and let us know.
  • Give us time to ship a fix before you publish – see below.

What we commit to

  • We acknowledge your report within five working days.
  • We come back with an initial assessment within ten working days and keep you posted afterwards.
  • We ship a fix and credit you as the finder if you want us to.
  • As long as you follow this policy and act in good faith, we will not pursue legal action against you.

We ask for coordinated disclosure: 90 days after your report or as soon as a fix is available, whichever comes first. If it takes us longer, we will tell you why.

We do not run a paid bug bounty programme.

Support period

For our Magento 2 extensions we handle reported vulnerabilities and publish security updates as new releases until at least 10/2031.

The support period that applies to an individual extension is stated in its documentation.

Actively exploited vulnerabilities

As a manufacturer of products with digital elements, we report actively exploited vulnerabilities and severe security incidents to ENISA and the BSI via the single reporting platform, as required by the Cyber Resilience Act (Regulation (EU) 2024/2847). Please point it out in your report if you have any indication that a vulnerability is already being exploited – a 24-hour deadline applies to us in that case.