MOYAFLOW Logo
DE
Navigation

Vulnerability Disclosure Policy

The security of our products and of our customers’ data is a top priority for MOYAFLOW. If you believe you have found a security vulnerability in one of our systems or products, we want to hear about it. This policy describes how to report vulnerabilities to us and what you can expect from us in return.

Scope

This policy covers:

  • STREAM Cloud and all of its components
  • STREAM Connect Agent
  • Websites and services operated by MOYAFLOW under moyaflow.de, moyaflow.com, and its subdomains

The following are out of scope:

  • Denial-of-service attacks, load or stress testing
  • Social engineering (e.g. phishing) against MOYAFLOW employees, customers or partners
  • Physical attacks against offices or data centers
  • Vulnerabilities in third-party services we use (e.g. Google Workspace, Cloudflare). Please report these directly to the respective vendor
  • Results of automated scanners without a demonstrated security impact, e.g. missing HTTP security headers, SPF/DKIM/DMARC configuration, or software version disclosure

How to report a vulnerability

Please send your report by email to security@moyaflow.de. We accept reports in English and German.

To help us assess the issue quickly, please include:

  • A short description of the vulnerability and its potential impact
  • The affected product, version, tenant or URL
  • Steps to reproduce or a proof of concept
  • Relevant timestamps, request IDs or log excerpts
  • A way to contact you for follow-up questions

Please do not include passwords, access tokens, private keys or confidential customer data in your report, and redact sensitive values in screenshots and logs.

Rules for testing

When investigating a vulnerability, please:

  • Only access, modify or delete data that belongs to you. Do not access other customers’ data
  • Avoid anything that could degrade the availability of our services or cause lasting changes
  • Stop testing and contact us immediately if you encounter customer data or an issue that could affect production
  • Not exploit a vulnerability beyond what is necessary to demonstrate it
  • Keep the vulnerability confidential until it has been resolved and we have agreed on disclosure

What you can expect from us

  • We will acknowledge your report within 3 business days.
  • We will send you an initial assessment within 10 business days.
  • We will keep you informed of our progress at least every 30 days until the issue is resolved.
  • We will treat your report confidentially and will not share your personal information with third parties without your consent.

Coordinated disclosure

We follow a coordinated disclosure process. We ask that you do not publish details about a vulnerability until a fix is available, or until 90 days after your report, whichever comes first. If a fix requires more time, we will discuss an extension with you. We will coordinate the timing and content of any public disclosure with you.

Safe harbor

We will not take legal action or file a criminal complaint against anyone who discovers and reports a vulnerability in good faith and in accordance with this policy. If a third party takes legal action against you for activities conducted in accordance with this policy, we will make it known that your actions were authorized by us.

Recognition

We do not currently offer a bug bounty or monetary rewards. With your consent, we are happy to credit you by name in our release notes or security advisories.

Product-specific information

Product-specific reporting details and release notes for STREAM Cloud and the STREAM Connect Agent can be found in the STREAM documentation.