Coordinated Vulnerability Disclosure Policy – EHRP

Version 1.0 – Last updated: 30 October 2026

The website ehrp.eu is operated by the initiating secretariat isento GmbH, Ostendstraße 242, 90482 Nuremberg, Germany on behalf of the European Humanoid Reference Platform (EHRP)("we", "us"). Reports of security vulnerabilities help us protect our collaborative platforms, working group infrastructures, and community contributions. This policy describes which systems you may examine, which rules apply, and what we commit to in return.

1. Scope

In scope (operated exclusively by us):

• ehrp.eu
• www.ehrp.eu

Out of scope:

• Implementations and robotics platforms of partner institutions, research facilities, or working group participants
• Physical humanoid robotics platforms, hardware controllers, and external field systems
• Third-party services embedded under our domains (e.g. via CNAME), and the infrastructure of our hosting and cloud providers as such
• Physical attacks and social engineering against platform contributors, staff, or partners

We also welcome reports of dangling DNS records (subdomain takeover). Please only demonstrate the issue; do not publish any content.

2. Relevant and Non-Relevant Findings

We are particularly interested in:

• Injection vulnerabilities, cross-site scripting (XSS), server-side request forgery (SSRF)
• Vulnerabilities in proposal and contact submission forms that lead to leakage or manipulation of data
• Exposure of credentials, keys, configuration files, or internal draft content
• Ways to modify website content or specification documents without authorization

Not considered a vulnerability under this policy:

• Missing security headers without demonstrated impact
• Clickjacking on pages without sensitive actions
• Self-XSS
• Findings related to SPF, DKIM, or DMARC
• Software version disclosure without demonstrated exploitability
• Missing rate limiting without demonstrated impact
• Unverified output from automated scanners

3. Rules of Engagement

• Do not impair the availability of our systems (no DoS/DDoS). Limit automated requests to a maximum of 5 per second.
• Do not submit bulk or spam entries through proposal or contact forms.
• Exploit a vulnerability only as far as strictly necessary to demonstrate it. No persistence, no backdoors, no pivoting to other systems.
• Do not use any credentials, tokens, or keys you discover; report them instead.
• If you gain access to data that is not yours, stop testing immediately, delete all local copies, report the finding without delay, and confirm the deletion upon our request.
• Do not modify or delete data that does not belong to you.
• Do not share information about the vulnerability with third parties before the coordination period has ended.
• If you are unsure whether an action is permitted, ask us first at security@isento.de.

4. Safe Harbor

If you (a) examine only systems in scope, (b) follow the rules in section 3, (c) do not demand any compensation, and (d) do not publish details or share them with third parties before the coordination period has ended, the following applies:

• We consent to your research within the framework of this policy. To that extent, we do not consider your access unauthorized within the meaning of Sections 202a, 202b, 303a and 303b of the German Criminal Code (StGB).
• We will not file a criminal complaint or request for prosecution, and we will not pursue civil claims against you, including claims under our terms of use.
• If third parties take action against you, we will confirm in writing upon request that you acted in accordance with this policy.

Please note: we cannot rule out investigations by law enforcement authorities, claims by third parties, or the rights of data subjects under the GDPR. We cannot grant consent for systems outside the scope of this policy.

5. No Compensation

We do not currently operate a bug bounty program and do not pay rewards. Reports combined with a demand for payment or a threat of publication fall outside this policy.

6. How to Report

• Email: security@isento.de
• Language: English or German

Please include:

• A description of the vulnerability and its potential impact
• Reproducible steps, affected URLs and parameters
• The time of your testing (UTC) and, if applicable, your source IP address(es), so we can match your activity in our logs

Our commitments:

• Acknowledgement of receipt: within 3 business days
• Initial assessment: within 10 business days
• Status updates: at least every 10 business days until resolved

7. Coordinated Disclosure

• The coordination period is 90 calendar days from our acknowledgement of receipt.
• If the vulnerability is fixed earlier, we will agree on a disclosure date with you.
• An extension is only possible by mutual agreement and with justification. If we cannot meet the deadline, we will inform you in advance.
• On request and with your consent, we will credit you by name or pseudonym on our acknowledgements page.

8. Data Protection

We process any personal data you submit with a report solely to handle the report and to communicate with you. For details, please see our privacy policy at /privacy/.

9. Final Provisions

This policy is governed by German law. It is available in German and English; in case of discrepancies, the German version prevails. We may amend this policy; reports already received are governed by the version in effect at the time of the report.