Vulnerability Disclosure Policy (VDP)

GPS Gesellschaft für Produktionssysteme GmbH

Effective from: May 29, 2026 | Version: 1.0

1. Introduction

Die GPS Gesellschaft für Produktionssysteme GmbH („GPS“) nimmt die Sicherheit ihrer Produkte und Dienste ernst. Wir begrüßen und ermutigen Sicherheitsforscher, Kunden und alle anderen Beteiligten, potenzielle Sicherheitslücken in unseren Produkten verantwortungsvoll zu melden. Diese Policy beschreibt, wie Sie Schwachstellen melden können, was Sie von uns erwarten dürfen und welche Produkte im Scope liegen.

2. Scope — Affected products and services

This VDP applies to all products and services of GPS GmbH with digital elements, in particular:
  • SICON.OS — Edge-Software-Plattform
  • SICON.PLUG — IoT sensor hardware including firmware
  • SICON.HW P50 — Edge-Gateway inkl. Software
  • VacuumAI — AI-based analysis platform (On-Cloud, On-Premises, On-Box)
  • MachineIQ — Machine monitoring platform
  • FactoryDataHub — UNS/MQTT Data Platform
  • sicon.eco — Website and associated online services
  • shop.sicon.eco — Online-Shop
Out of scope: Products and services of J. Schmalz GmbH (parent company) as well as third-party components that do not fall under GPS responsibility. Vulnerabilities in third-party components used in GPS products (e.g., open-source libraries) are within scope, provided the vulnerability is exploitable via a GPS product.

3. Reporting a vulnerability

Important information regarding secure transmission: Bitte senden Sie keine sensiblen Exploit-Details, Proof-of-Concept-Code oder Passwörter unverschlüsselt per E-Mail.

Please start by sending us a brief summary of the vulnerability you have found to security@gps-stuttgart.de.

Please describe:
  1. Affected product — Name, version, deployment variant (On Cloud/On Prem/On Box)
  2. Description of the vulnerability — What is the problem? What impact does it have?
  3. Reproduction steps — How can the vulnerability be reproduced?
  4. Impact — What damage could an attacker cause? (e.g., data access, denial-of-service, code execution)
  5. Your contact details — So that we can ask follow-up questions (optional; anonymous reports are accepted)
Languages: German and English. Our security team will contact you straight away and provide you with a secure, encrypted channel (e.g. a temporary upload link) for submitting the detailed technical data.  

4. Our Promise to You (Safe Harbor)

If you act in good faith and in accordance with this Policy, we agree to:
  • Not to initiate or support any legal action against you relating to your security research.
  • Not to initiate criminal prosecution, provided you comply with the rules listed below.
  • To treat your report confidentially and to publish your name only with your express consent.
  • Communicating promptly — we will acknowledge receipt of your report within 5 working days and keep you regularly informed of the status of the process.

5. Our response times

Schritt Deadline
Acknowledgement of receipt 5 working days
Initial assessment and feedback 15 working days
Remediation of critical vulnerabilities (CVSS ≥ 9.0) As quickly as possible, goal: 30 days
Remediation of high-severity vulnerabilities (CVSS 7.0–8.9) Goal: 60 days
Remediation of medium-severity vulnerabilities (CVSS 4.0–6.9) Ziel: 90 Tage
Behebung niedriger Schwachstellen (CVSS 0.1–3.9) Ziel: Im Rahmen regulärer Release-Zyklen (ohne feste Frist)
Publication (Coordinated Disclosure) After resolution, in coordination with the person who reported the issue

6. Rules for security researchers

  • No destruction: Do not delete, modify, or encrypt data that does not belong to you.
  • No interruption: Do not cause denial-of-service attacks or service disruptions.
  • No data exfiltration: Do not copy personal data or trade secrets beyond the minimum necessary to demonstrate the vulnerability.
  • No disclosure: Do not publish details about the vulnerability before we have fixed it and a coordinated release has been agreed upon (Coordinated Vulnerability Disclosure).
  • Own systems only: Test only systems that you own or for which you have express authorization. Please contact us in advance regarding tests on GPS cloud services.

7. Coordinated Vulnerability Disclosure (CVD)

GPS follows the principle of coordinated disclosure in accordance with Delegated Regulation (EU) 2026/881.
  • We are working with the reporter to determine a joint publication date.
  • We report actively exploited vulnerabilities to the competent authorities (ENISA / BSI) in accordance with legal requirements (EU CRA, Regulation 2024/2847).
  • We publish security advisories on gps-stuttgart.de/produktsicherheit after the vulnerability has been fixed.

8. Acknowledgement

We recognize responsible security research. With your consent, we will credit you as the discoverer of the vulnerability in our security advisories. There is currently no formal bug bounty program.

9. Contact and further information

E-Mail security@gps-stuttgart.de
security.txt gps-stuttgart.de/.well-known/security.txt
Company GPS Gesellschaft für Produktionssysteme GmbH, Nobelstraße 15, 70569 Stuttgart
Legal form GmbH, Handelsregister Stuttgart

10. Revision History

Version Date the change
1.0 2026-05-29 First publication
This vulnerability disclosure policy complies with the requirements of EU Regulation 2024/2847 (Cyber ​​Resilience Act), Article 13(6), and is aligned with the recommendations of the BSI and ISO/IEC 29147:2018 (Vulnerability Disclosure).