Responsible Disclosure Policy

Security is at the core of everything we do at DSwiss AG. Despite our best efforts, vulnerabilities may still exist. If you have discovered a security vulnerability in one of our systems, we appreciate your help in disclosing it to us responsibly. We are committed to working with security researchers to verify and address reported issues.

Scope

This policy applies to the following systems operated by DSwiss AG:

• www.securesafe.com and the SecureSafe web application
• SecureSafe mobile applications (iOS and Android)
• SecureSafe browser extension
• SecureSafe desktop application

Systems operated by third parties are out of scope, even if linked from our services.

Out of scope

The following are not considered qualifying vulnerabilities and should not be tested:

• Denial-of-service (DoS/DDoS) attacks or resource-exhaustion testing
• Social engineering, phishing, or physical attacks against DSwiss employees, offices, or data centers
• Spam, SPF/DKIM/DMARC configuration opinions without demonstrated impact
• Vulnerabilities requiring outdated browsers or platforms
• Clickjacking on pages with no sensitive actions
• Automated scanning that generates significant traffic
• Vulnerabilities in third-party services

How to report

Please report vulnerabilities to security@dswiss.com.

Include where possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce (proof of concept, screenshots, or scripts)
• The affected system, URL, or app version
• Your contact details for follow-up questions

You may report anonymously; however, we cannot keep you informed of progress without contact details.

Rules of engagement

When investigating a potential vulnerability, we ask that you:

• Do not access, modify, or delete data belonging to other users. If a vulnerability exposes data that is not yours, stop immediately and report it.
• Limit testing to the minimum necessary to demonstrate the vulnerability (proof of concept only, no data exfiltration).
• Do not disrupt our services or degrade the experience of our users.
• Do not use the vulnerability for your own or a third party's benefit.
• Give us reasonable time to remediate before any public disclosure (see coordinated disclosure below).

Our commitments

• We will acknowledge your report within 5 business days.
• We will provide an initial assessment and keep you informed about remediation progress.
• We remediate confirmed vulnerabilities in line with our internal patch management standard. Critical vulnerabilities in production systems are addressed within 48 hours of a fix being available.
• We practice coordinated disclosure: we ask you to refrain from public disclosure for 90 days from your report or until a fix is deployed, whichever comes first. We are happy to agree on a coordinated publication with you.

Safe harbor

DSwiss will not initiate legal action against security researchers who, in good faith:

• comply with this policy and the rules of engagement above,
• report their findings promptly and exclusively to us, and
• do not compromise the privacy or safety of our customers or the availability of our services.

We consider research conducted in accordance with this policy to be authorized and welcome.

Recognition

We do not currently operate a paid bug bounty program. With your consent, we are happy to acknowledge meaningful contributions.

Our vulnerability handling is aligned with ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling processes) and forms part of our ISO/IEC 27001-certified information security management system. Reports may also be coordinated through the Swiss National Cyber Security Centre (NCSC) coordinated vulnerability disclosure program.