Report a Vulnerability

Axel Semrau GmbH takes the security of its products seriously. If you have discovered a security vulnerability or a security-relevant incident in Chronos or another Axel Semrau product, please help us and all users by reporting it to us.

How to submit a report

Please send your report to:

psirt@trajanscimed.com

If you would like to submit sensitive technical details (e.g. proof-of-concept code), please encrypt them where possible or ask us in advance for a secure transmission channel.

For confidential reports, our OpenPGP key is available.

What information helps us

To help us assess your report quickly, please include the following information where possible:

  • Affected product and version (e.g. Chronos 5.12)
  • A brief description of the vulnerability or incident
  • Steps to reproduce, if known
  • Potential impact (e.g. on confidentiality, integrity, availability)
  • Your contact details for follow-up questions
  • If available: proof-of-concept, log excerpts, or screenshots

An incomplete or preliminary report is also welcome – we are happy to work with you to clarify any missing details.

What happens after you report

1. Acknowledgment: We confirm receipt of your report promptly.

2. Assessment: Our Product Security Team reviews the report and keeps you updated on its status.

3. Remediation: For confirmed vulnerabilities, we work on a fix and inform you of the timeline.

4. Publication: We communicate security-relevant updates through our usual update channels. If you wish, and with your consent, we will credit you as the reporter.

Further information

The complete rules on scope, timelines, and our commitment to security researchers (Safe Harbor) can be found in our detailed Security Policy.

A machine-readable summary of this contact information is also available as security.txt in accordance with RFC 9116.

Legal background

As a manufacturer of products with digital elements, Axel Semrau GmbH is subject to the reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847). We report actively exploited vulnerabilities and serious security incidents to the competent authorities within the legally required framework.

Note

This process is intended for reporting security vulnerabilities. For general support requests, please contact our regular customer support.