Coordinated Vulnerability Disclosure Policy
A short, practical guide to reporting a vulnerability is available here: Report a Vulnerability. This page describes the complete policy.
Axel Semrau GmbH takes the security of its products with digital elements – including the Chronos software – very seriously. We are grateful for every responsible report of a security vulnerability from security researchers, customers, and other third parties, and we are committed to handling such reports in a transparent, coordinated manner.
This policy implements the requirements for a “coordinated vulnerability disclosure policy” under Article 13 and Annex I, Part II, point 6 of Regulation (EU) 2024/2847 (Cyber Resilience Act, CRA).
Reporting Channel
| psirt[at]trajanscimed.com | |
| Machine-readable information | https://www.axelsemrau.de/.well-known/security.txt (per RFC 9116) |
| Quick guide | Report a vulnerability |
| Languages | German, English |
| Encryption | OpenPGP key (see also the Encryption field of security.txt) |
Scope
In scope
- The Chronos software in all versions actively supported by Axel Semrau GmbH, as well as its installers.
- First-party plug-in components, processing modules, and data providers that we ship.
- The application's update, licensing, and crash/telemetry handling.
- Other products with digital elements distributed by Axel Semrau GmbH.
Out of scope
- Third-party mass-spectrometer instrument drivers and vendor SDKs (Thermo, Sciex, Bruker, Waters, ProteoWizard, etc.) – please report these directly to the respective vendor.
- Vulnerabilities in third-party components, operating systems, or third-party software that merely interoperate with our products but are not developed by us (please report directly to the respective vendor; a list of the third-party components included in Chronos can be found in the software bill of materials/SBOM).
- The security of the user's own operating system, hardware, or network.
- Vulnerabilities in dependencies that are already publicly known and awaiting an upstream fix (though we welcome a heads-up).
- Social engineering attacks against employees, customers, or clients.
- Physical attacks on the premises, devices, or infrastructure of Axel Semrau GmbH or its customers.
- Denial-of-service testing or other tests that could impair the operation of production systems.
What a Report Should Contain
See Report a Vulnerability for the complete list of helpful information.
Our Process
| Acknowledgment of receipt | Within 5 business days of receiving your report. |
|---|---|
| Initial assessment | Within 10 business days – classification of severity and impact, with follow-up questions if needed. |
| Remediation | Depends on severity and complexity; we will keep you informed of progress at reasonable intervals. |
| Coordinated disclosure | Unless otherwise agreed, we aim to disclose within 90 days of receiving the report, or as soon as remediation is available. |
| Reporting to authorities | Where legally required—particularly for actively exploited vulnerabilities under Article 14 of the CRA—we also report to ENISA and the competent national authority, independently of and in addition to our communication with you as the reporter. |
Our Commitment to Reporters (Safe Harbor)
We consider security research conducted in good faith, in accordance with this policy, and without intent to cause harm to be authorized. In particular, we will:
- not pursue legal action for responsible security research conducted under this policy,
- treat your report as confidential and not share your contact information with third parties without your consent, except where legally required (see the “Our Process” section).
Supported Versions and Security-Update Period
Each released version of Chronos receives security updates for at least five (5) years from its release date, in line with the support-period expectation in Article 13(8) of the Cyber Resilience Act (EU), unless a shorter expected product lifetime is documented for a specific release. Remediation is generally provided through a free update to the respective latest version; as a rule, we do not offer retroactive security patches for individual older versions. We therefore recommend always running the latest version and installing available updates promptly.
| Latest version | Fully supported – receives security updates |
|---|---|
| Older version within the 5-year support window | No direct patch for the installed version – a free update to the latest version is available to remediate security issues |
| Past its 5-year support window | End of life – please update |
The support periods stated in the respective product information apply accordingly to the other products with digital elements covered by this policy.
Recognition
We do not currently operate a paid bug bounty program, but we are happy to credit researchers who report valid issues in the relevant security advisory (with your permission).
Legal Basis
This policy implements the requirements of Article 13 and Annex I, Part II, point 6 of Regulation (EU) 2024/2847 (Cyber Resilience Act) for a coordinated vulnerability disclosure policy. The reporting channel is additionally published in machine-readable form at https://axelsemrau.de/.well-known/security.txt in accordance with RFC 9116.
Contact
Axel Semrau GmbH · Stefansbecke 42 · 45549 Sprockhövel · Germany
info.de[at]trajanscimed.com · www.axelsemrau.de
