Product Security Incident Response Team (PSIRT)

The security of our machines, control systems, software solutions, and digital services is a top priority for FOOKE GmbH. We consider current product security and information security requirements throughout the development and continuous improvement of our products.

Despite thorough development, testing, and quality assurance processes, potential security vulnerabilities cannot be completely ruled out. We therefore welcome reports from customers, business partners, security researchers, and other third parties that help identify and remediate potential vulnerabilities.

Contact for Security Reports

If you have identified a potential security vulnerability in a product or service provided by FOOKE GmbH, please report it to our Product Security Incident Response Team (PSIRT):

psirt[at]​fooke.de

Please use this contact channel exclusively for reports related to product security vulnerabilities.

Information to Include in Your Report

To enable an appropriate assessment of the reported issue, please provide the following information where available:

• Affected product or system
• Machine, equipment, or serial number
• Installed software, firmware, or control system version
• Description of the suspected vulnerability
• Information enabling verification or reproduction of the issue
• Potential impact of the vulnerability
• Technical evidence, screenshots, or log files
• Contact information for follow-up questions

Reports that do not contain all of the above information may still be reviewed.

Principles of Responsible Disclosure

FOOKE GmbH supports responsible and coordinated vulnerability disclosure ("Coordinated Vulnerability Disclosure").

We therefore ask individuals reporting vulnerabilities to:

• Report identified vulnerabilities to us confidentially before making them public.
• Refrain from public disclosure until FOOKE GmbH has had a reasonable opportunity to assess and address the reported issue.
• Avoid actions that could negatively affect systems, machinery, services, or data.
• Refrain from accessing, modifying, deleting, or downloading data without explicit authorization.
• Comply with all applicable laws and regulations at all times.

Submitting a vulnerability report does not establish any contractual relationship, engagement, compensation entitlement, or other obligation on the part of FOOKE GmbH.

Handling of Vulnerability Reports

Upon receipt of a report, the responsible departments within FOOKE GmbH will review the reported issue.

The review process may include the following steps:

• Registration and documentation of the report
• Technical assessment and validation
• Risk evaluation
• Review of potential mitigation measures
• Implementation of appropriate corrective or protective actions
• Notification of affected customers or partners where deemed necessary

Submitting a report does not create an entitlement to receive feedback, disclosure of investigation results, or implementation of specific measures.

Scope

This policy applies exclusively to products, software, and digital services provided or operated by FOOKE GmbH.

The following are explicitly excluded from the scope of this policy:

• Products and services provided by other manufacturers
• Third-party systems
• Components over which FOOKE GmbH has no direct control regarding development or operation

Confidentiality

Information submitted as part of a vulnerability report will be used solely for the purpose of investigating and handling the reported issue, unless legal retention, disclosure, or reporting obligations require otherwise.

Data Protection

Personal data will be processed only to the extent necessary for handling the submitted report and in accordance with applicable data protection laws and regulations.

For more information about how personal data is processed, please refer to our Privacy Policy.