Report a Vulnerability

The security of our products, software solutions and digital services is a high priority for SIKA. Despite careful development and testing, security vulnerabilities cannot be completely ruled out.

If you discover a potential security vulnerability in a SIKA product, software solution or digital service, please report it to us. We carefully review all reports received and coordinate any necessary measures with the relevant internal and external parties.

This policy describes how security vulnerabilities can be reported to SIKA and the rules that must be observed when investigating vulnerabilities and coordinating their disclosure.

Scope

This reporting channel is intended in particular for potential security vulnerabilities in the following areas:

• products with digital elements offered under the SIKA name or brand
• firmware and embedded software in SIKA products
• PC software, web applications and mobile applications from SIKA
• digital interfaces and communication functions of SIKA products
• configuration, update and remote maintenance functions
• product-related online and cloud services operated by SIKA
• websites and other digital services operated directly by SIKA

This may include, for example, vulnerabilities relating to authentication, access permissions, data transmission, encryption, software updates, network interfaces or input processing.

The following issues are not handled through this reporting channel:

• general product inquiries or technical support cases
• functional errors without security-related impact
• data protection inquiries
• compliance or whistleblower reports
• security issues in third-party products and services for which SIKA is not responsible
• results from automated scans without a comprehensible technical assessment

For these matters, please use the appropriate contact options provided on our website.

How to Report a Vulnerability

Please send your report to:

Email for product-related security reports: PSIRT(at)sika.net
Email for IT infrastructure-related security reports: CSIRT(at)sika.net

Recommended subject line: Vulnerability – [product or service] – [brief description]

Reports may be submitted in German or English.

For confidential or particularly sensitive information, we recommend encrypted transmission. Our public OpenPGP key is available here:

OpenPGP key: to follow
Fingerprint: to follow

Please do not send executable files, malware or other potentially harmful content by email without prior agreement. Please coordinate secure transmission with us first.

If you suspect that a vulnerability is already being actively exploited, please mark your message with “CRITICAL” in the subject line and explicitly state this in the first paragraph.

Information Required

The more precise your report is, the faster we can assess the issue. Where possible, please provide the following information:

• exact product or service name
• article number, model or product variant
• firmware or software version used
• affected interface, component or function
• description of the vulnerability
• potential security-related impact
• prerequisites for exploitation
• reproducible steps
• where applicable, a non-destructive proof of concept
• relevant log data, screenshots or error messages
• details of the affected configuration or system environment
• information on whether the vulnerability has already been disclosed publicly or reported to third parties
• information on whether there are indications of active exploitation
• your contact details and preferred secure method of communication

Please provide only data that is necessary for the technical assessment. Passwords, private keys, personal data or confidential customer data should not be included in the report.

Anonymous reporting is generally possible via the form. However, without a means of contacting you, we cannot ask follow-up questions or keep you informed about the status of the report.

Rules for Responsible Security Research

Please observe the following principles when investigating a potential security vulnerability:

• Only investigate systems that you own or systems for which you have been expressly authorized to perform security testing.
• Limit your activities to the minimum necessary.
• Avoid adversely affecting the availability, stability or security of products and services.
• Do not perform denial-of-service attacks or load tests.
• Do not use malware or establish persistent access.
• Do not modify or delete data or configurations.
• Do not access or download third-party data.
• Stop your investigation as soon as you unintentionally gain access to personal, confidential or production data.
• Do not conduct social engineering, phishing or other deceptive activities against SIKA employees, customers or partners.
• Do not exploit a vulnerability for your own or another party’s financial benefit.
• Do not disclose any details before a coordinated disclosure process has been completed.
• Comply with all applicable legal and contractual requirements.

Publication of this policy does not constitute general authorization to test SIKA products, systems, networks or services without consent.

Where security research is conducted in good faith, proportionately and in accordance with this policy, SIKA does not intend – to the extent permitted by law and provided there is no apparent intent to cause harm or obtain an improper benefit – to initiate legal action solely on the basis of such activities.

How We Handle Your Report

Once a report has been received, the process will generally be as follows:

1. Acknowledgement of Receipt

We generally acknowledge receipt of your report within one business day. If a report is unclear or incomplete, we may request additional information.

2. Technical Assessment

Our responsible specialist departments assess whether the reported vulnerability can be reproduced, which products or versions are affected and what potential impact it may have. Depending on the circumstances, affiliated companies, suppliers, technology partners or external security experts may also be involved.

3. Assessment and Prioritization

Confirmed vulnerabilities are assessed and prioritized based on their technical exploitability, potential impact and likelihood of exploitation.

4. Remediation and Protective Measures

Depending on the assessment, appropriate measures may include, for example:

• a firmware or software update
• a configuration change
• a technical workaround
• temporary risk mitigation
• updated security advisories or documentation
• notification of affected customers and users

5. Coordinated Disclosure

Where possible, SIKA coordinates any potential disclosure with the reporting party and other affected parties. The timing will depend, among other factors, on the severity of the vulnerability, the availability of a remediation measure and the risks to users.

Disclosure should only take place once a suitable fix or risk mitigation measure is available or another disclosure date has been mutually agreed.

6. Closure

Once appropriate measures have been made available, we will, where possible, inform the reporting party that the case has been closed. For suitable vulnerabilities, the assignment or coordination of a CVE identifier may also be considered.

Confidentiality

SIKA treats security reports and the identity of the reporting party as confidential as a general principle.

Disclosure to third parties may be necessary where required for investigation, remediation or compliance with statutory reporting obligations. This may include, in particular, competent authorities, affiliated companies, suppliers, development partners or commissioned security experts.

The reporting party will only be named or publicly acknowledged with their prior consent.

Compensation and Bug Bounty Program

SIKA does not currently operate a public bug bounty program. Reporting a security vulnerability therefore does not give rise to any entitlement to financial or other compensation.

Voluntary recognition of exceptional contributions remains subject to an individual decision by SIKA.

Security Advisories

Published security advisories concerning SIKA products and digital services will be made available in this section.

There are currently no published security advisories.

Support Periods and Security Updates

Product-specific information on support periods, the provision of security updates and secure product configurations can be found in the relevant product documentation, on the corresponding product page or in the associated security advisories.

This page does not replace product-specific information and instructions.

Other Inquiries

Bitte nutzen Sie für andere Anliegen die dafür vorgesehenen Kontaktwege:

• General product inquiries: Product Inquiries
• Data protection: Privacy Policy
• Compliance and whistleblowing system: Compliance
• Press inquiries: Press Contact