Welcome to NCIEM.DE
  • All Categories
Product Suggestions
ALL CATEGORIES

Vulnerability Disclosure Policy

As of 16 October 2026

National Company for Industrial Equipment Marketing NCIEM UG (haftungsbeschränkt) welcomes reports of security vulnerabilities in nciem.de. If you believe you have found one, please tell us at [email protected] with the subject “Security vulnerability”. We will work with you to confirm and fix it.

Quick reference: report to [email protected] · acknowledgement within 3 working days · initial assessment within 10 working days · please allow 90 days before public disclosure · no bug bounties at present.

1. Our approach

Good security depends on mutual trust between us and the people who report problems to us. Your reports help us protect our customers’ accounts, orders and payment data. We accept reports from anyone: independent security researchers, customers, suppliers, partners and consultants.

A security vulnerability is an unintended weakness that could be used to compromise the confidentiality, integrity or availability of our website, systems or data.

2. Scope

In scope:

  • https://nciem.de and all its pages, including the German and English shop, customer accounts, cart, checkout and the “Vertrag widerrufen” form;
  • other systems operated by NCIEM UG for nciem.de.

Out of scope:

  • websites of other NCIEM companies (nciem.us, nciem.com), which have their own contacts;
  • third-party services we use, such as PayPal, Stripe, LiveChat, Google Maps, Cloudflare, GoDaddy, Microsoft 365 and Mailgun. Please report problems in these directly to the provider;
  • findings with no realistic security impact, for example missing security headers without a working exploit, self-XSS, clickjacking on pages with no sensitive actions, or software version banners;
  • results from automated scanners that you have not verified.

3. How to report

Send your report to [email protected], in German or English, with the subject “Security vulnerability” so that it is routed to the right person at once. Please include:

  • the affected URL or component;
  • a description of the vulnerability and its possible impact;
  • the steps to reproduce it, with screenshots or a proof of concept if possible;
  • your contact details, if you want us to reply or credit you.

Please do not report vulnerabilities through the live chat, social media or public review functions.

4. Our commitments to you

  • Trust: we treat your report and your identity confidentially and do not share them without your consent, unless the law requires it.
  • Respect: we treat everyone who reports in good faith with respect, and with your agreement we name you on this page as thanks.
  • Transparency: we confirm receipt within 3 working days, give you an initial assessment within 10 working days, and keep you informed until the issue is fixed.
  • Common good: we fix confirmed vulnerabilities as quickly as their severity requires, with the protection of affected customers first.

We do not currently pay rewards (bug bounties).

5. What we ask of you

  • Trust: give us reasonable time to fix the issue before you tell anyone else. We suggest 90 days from your report, or sooner by agreement once a fix is live.
  • Respect: avoid privacy violations, disruption of the shop and destruction of data. Do not run denial-of-service, spam or social-engineering tests, and do not attack our staff, suppliers or premises.
  • Data protection: access only as much data as is needed to show the vulnerability. Use your own test accounts. If you come across other people’s personal data, stop, do not keep or share it, and tell us.
  • Transparency: give us enough technical detail to understand and reproduce the problem.
  • Common good: do not publish or exploit an unconfirmed vulnerability, and do not use it beyond what is needed for your report.

6. Safe harbour

If you act in good faith and follow this policy, we will consider your research authorised. We will not take legal action against you or report you to law enforcement for it. If a third party takes legal action against you over research that complied with this policy, we will make clear that your actions were authorised. This policy cannot authorise testing of systems that belong to third parties.

As of 16 October 2026 · National Company for Industrial Equipment Marketing NCIEM UG (haftungsbeschränkt) · Lohmühlenstraße 65 · 12435 Berlin · Germany · [email protected]

Privacy settings