# Vulnerability handling – Feldmelder

Applies to the Feldmelder portal (this repository), the field controller runtime ("Beyin", `beyin/`), the tracker
control unit firmware (`feldmelder-tcu`) and the protocol TTP v1. Version 1, 2026-10-30.

## How to report

* **Contact form** (always available, every report is stored): `https://feldmelder.de/kontakt?form=security`
* **E-mail:** `security@feldmelder.de` – *only once the owner has set up the mailbox or forwarding*; until then the
  address is not shown on the website or in `security.txt` (`SECURITY_CONTACT_EMAIL` in `.env`, DECISIONS D-041).
* Machine-readable: `https://feldmelder.de/.well-known/security.txt` (RFC 9116).

Please include what is affected (address, device, version), how to reproduce it and the impact you expect. Do not
access or change data of others, do not degrade the service for other users, and do not send passwords or
personal data of others.

## What we do – and the timelines we can keep

Feldmelder is a small team in its pilot phase. The timelines below are what we commit to; they are targets for
the fix, not guarantees of one.

| Step | Timeline |
|---|---|
| Confirm receipt to the reporter | within **5 working days** |
| First assessment (affected? severity using CVSS v3.1/v4.0, exploited?) shared with the reporter | within **10 working days** |
| Fix or mitigation available – target | critical: **30 days**, high: **60 days**, medium/low: next regular release |
| Coordinated disclosure | by agreement with the reporter; default **90 days** after the report or when the fix is available, whichever is earlier |
| Credit | in the release notes, if the reporter wishes |

Every report is tracked as an enquiry of type "security" in the portal (`/sa/leads`, status and notes, audited),
so no report depends on one person's mailbox.

## Inside the team

1. Reproduce and assess; decide severity; record the decision.
2. Fix in a branch; tests including a regression test; review.
3. Release: portal – rebuild and deploy per `docs/runbook.md`; field devices – firmware update procedure (OTA is not
   implemented yet, so field devices are updated on site until it is – ROADMAP).
4. Inform the reporter and, where relevant, the affected customers (security advisory), and record the
   vulnerability and the fix in `CHANGELOG.md`.
5. Check the SBOM (`docs/security/sbom-portal.cdx.json`) for other places the same component is used.

## Known components and automated checks

* SBOM in CycloneDX format of what is deployed: `docs/security/sbom-portal.cdx.json`, generated from the app image by
  `tools/make_sbom.py` together with the exact package list `docs/security/requirements-lock.txt`.
* `tests/test_security_basics.py` runs `pip-audit` against that list in the test suite; a finding fails the tests
  unless it is listed with a reason and a review date in `docs/security/pip-audit-allowlist.txt`.
* Vendored browser libraries and container base images are listed in the SBOM metadata and in
  `web/static/vendor/VENDOR.md`; they are updated by hand (ROADMAP: automated checks for them).

## EU Cyber Resilience Act (Regulation (EU) 2024/2847)

* The reporting obligations of Article 14 apply since **11 September 2026**: a manufacturer reports actively
  exploited vulnerabilities and severe incidents affecting its products with digital elements, with an early
  warning within **24 hours** of becoming aware, through ENISA's single reporting platform to the CSIRT designated
  as coordinator. The later stages (notification and final report) and their deadlines are defined in Article 14 –
  **check the text in the Official Journal before the first report** (sources: docs/SOURCES.md).
* Status today: Feldmelder is in its pilot phase and has not placed products with digital elements on the EU
  market yet. This process is set up so that it is in place from the first delivery of a field controller or TCU.
  Which parts fall under the CRA (portal as remote data processing of the product, field controller, TCU) is part
  of the CRA documentation that is still planned (ROADMAP) – this page claims no conformity or certification.