FOOKE Product Security (PSIRT)

At FOOKE GmbH, the security of our machine tools, control systems, software applications, and digital services is a top priority. Security considerations are integrated throughout the design, development, and ongoing enhancement of our products to help protect our customers' operations and data.

While we maintain rigorous engineering, testing, and quality assurance processes, no product can be guaranteed to be entirely free of security vulnerabilities. We welcome responsible reports from customers, partners, security researchers, and other members of the security community that help us identify and address potential security issues.

Product Security Contact

If you believe you have identified a security vulnerability affecting a product or service provided by FOOKE GmbH, please report it to our Product Security Incident Response Team (PSIRT):

psirt[at]​fooke.de

This email address is intended exclusively for reports related to product security vulnerabilities.

Information to Include in Your Report

To help us investigate and assess the reported issue, please provide the following information whenever possible:

• Affected product or system
• Machine, equipment, or serial number
• Installed software, firmware, or control system version
• Detailed description of the suspected vulnerability
• Steps required to reproduce or verify the issue
• Potential impact and security implications
• Supporting technical evidence, screenshots, or log files
• Contact information for follow-up communication

Reports that do not contain all of the above information will still be reviewed.

Responsible Disclosure Guidelines

FOOKE GmbH supports responsible and coordinated vulnerability disclosure practices.

We respectfully request that security researchers and other reporting parties:

• Report potential vulnerabilities to FOOKE confidentially before publicly disclosing them.
• Allow FOOKE a reasonable opportunity to validate and address the reported issue prior to public disclosure.
• Refrain from activities that could disrupt, damage, or negatively affect systems, equipment, services, or data.
• Do not access, modify, delete, copy, or download data without explicit authorization.
• Comply with all applicable local, national, and international laws and regulations.

Submission of a vulnerability report does not create an employment relationship, consulting agreement, compensation entitlement, or any other contractual obligation on the part of FOOKE.

How We Handle Security Reports

Upon receipt of a vulnerability report, FOOKE's relevant technical and security teams will review and evaluate the information provided.

Our review process may include:

• Acknowledgment and registration of the report
• Technical validation and analysis
• Risk and impact assessment
• Evaluation of mitigation options
• Implementation of appropriate corrective or protective measures
• Notification of affected customers or partners when deemed necessary

FOOKE does not guarantee individual responses, disclosure of investigation results, or implementation of specific remediation measures.

Scope

This policy applies solely to products, software, and digital services that are provided, operated, or maintained by FOOKE GmbH.

The following are outside the scope of this policy:

• Products or services provided by third-party manufacturers
• Third-party systems and infrastructure
• Components or technologies over which FOOKE has no direct operational or development control

Confidentiality

Information submitted as part of a vulnerability report will be treated confidentially and used solely for investigating and addressing the reported issue, except where legal, regulatory, or compliance obligations require disclosure.

Privacy

Any personal information submitted in connection with a vulnerability report will be processed only as necessary to review, investigate, and respond to the reported issue, and in accordance with applicable data protection and privacy laws.

For additional information regarding the processing of personal data, please refer to our Privacy Policy.