Security
If you have found a vulnerability in a Quorvyn application or on this website, please report it confidentially to security@quorvyn.de.
What the report should contain
- The affected product, its version and the platform
- The impact, meaning what someone could do with it
- The steps to reproduce it
- Whether personal data could be exposed
Please do not include real customer or patient data. A constructed sample is enough for the analysis and keeps a report from becoming a data protection incident of its own.
Published advisories
When a vulnerability or an incident affects users, we publish it under Security advisories, together with a machine-readable version. For everyone who uses an application without an account, that is the only way we can reach them. There is neither telemetry nor an update check, so we hold no address for them.
What you can expect
We check the inbox every day, weekends included, and confirm receipt within 48 hours. These are two separate commitments on purpose, because a report that arrives on a Friday evening would otherwise not even be noticed before Monday. After that we get back to you with an assessment and, if the report is accurate, with a timetable for the fix.
Quorvyn is a one-person business. There is therefore no on-call service outside business hours and no second person who could check our work independently. That is a known structural limit and not an oversight.
Please do not
- Publish any details before a fix is available
- Run tests that put third party data at risk, disrupt services or touch other people's accounts
Supported versions
Security fixes go to the latest supported version of each product.