Responsible Vulnerability Disclosure Policy

Information for Reporting Security Vulnerabilities

1. Purpose of the Document

In accordance with European legislation (the EU Cyber Resilience Act – CRA and the NIS2 Directive), national recommendations (NBÚ, SKCERT) and international standards (ISO/IEC 29147, RFC 9116), ANASOFT APR, spol. s r.o., publishes the mandatory information and contact channels required for the secure and confidential reporting of security incidents and vulnerabilities.

2. Scope

Products with digital elements: Signatus, Emans, Domus and Finus, as well as all related cloud components required for their operation.

3. Single Point of Contact

The company operates a dedicated security incident response team (PSIRT / CSIRT) to receive reports of vulnerabilities, security weaknesses or incidents:

4. Communication Encryption (OpenPGP)

To protect sensitive technical details until the reported issues are resolved, we recommend encrypting all reports using our public PGP key:

5. Machine-Readable File (security.txt)

In accordance with RFC 9116, a machine-readable security.txt file is published on our websites at:

https://www.anasoft.com/.well-known/security.txt

Contents of the security.txt file:

  • Contact: mailto: cybersec@anasoft.com

6. Required Report Content

To enable us to verify a reported incident or vulnerability as quickly as possible, please provide the following information:

  1. Asset identification: Name of the affected product, version, web address (URL) or IP address.
  2. Problem description: Type of vulnerability or nature of the incident (e.g. unauthorised access, an application flaw or a data leak).
  3. Steps to reproduce: Detailed steps to verify the vulnerability (proof of concept, code or screenshots).
  4. Estimated impact: Impact on the confidentiality, integrity or availability of data and systems.
  5. Contact details: Name and email address for further communication (optional if you wish to remain anonymous).

7. Safe Harbor Commitment

The company guarantees that, in relation to individuals and researchers who act in good faith and follow the rules of responsible disclosure, it will:

  • Take no legal action (civil or criminal) and will not report their activities to law enforcement authorities.
  • Not require a non-disclosure agreement (NDA) to be signed as a condition for accepting or resolving a report.

Reporters are required to:

  • Avoid damaging systems, modifying other users’ data or causing such data to be leaked.
  • Refrain from DoS/DDoS attacks, spam, brute-force attacks or social engineering.
  • Not publish code or instructions on how to exploit the vulnerability.
  • Maintain confidentiality until the company coordinates disclosure of the fix.

8. Response Timeframes (SLA)

Response stage

Guaranteed timeframe

Description

Acknowledgement of receipt

Within 48 hours (maximum 5 working days)

Sending an acknowledgement with an assigned internal report identifier.

Initial assessment (Triage)

Within 7 calendar days

Verifying the vulnerability, determining its severity according to CVSS and informing the reporter.

Regular updates

Every 14 days

Providing updates on the development of the security fix until it is deployed.

9. Information on the Publication of Fixes (Security Advisories / VEX)

After a security fix has been successfully developed and deployed, the company publishes information on resolved vulnerabilities in the form of security advisories at:

https://www.anasoft.com/en/pages/security/advisories

The advisories are published in standardised CSAF / VEX formats and include the assigned CVE identifier, CVSS severity and instructions for users on applying updates.

Responsible Vulnerability Disclosure Policy

Version: No. 1.0

Information for Reporting Security Vulnerabilities

Last updated:

7 October 2026

Approved: 11 September 2026