Richtlinie zur Offenlegung von Schwachstellen

1. Purpose

OakHost OÜ welcomes reports of security vulnerabilities in its products and handles them through coordinated disclosure: we fix first, then publish, and we keep the reporter informed throughout.

This policy is OakHost's coordinated vulnerability disclosure policy under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), Article 13 and Annex I Part II. It follows the principles of ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling).

Version 1.0. Published at https://www.oakhost.com/security.

2. Scope

This policy covers all supported versions of these products:

This includes their installers, update mechanisms, and the OakHost server endpoints they communicate with (update, connection validation, metrics and command API endpoints, and the backend behind them).

We also accept reports about OakHost's websites and customer portal at www.oakhost.com and customer.oakhost.com under the same process. The regulatory commitments in sections 7 and 9 apply to the products above.

Out of scope:

• Third-party hosting providers and their infrastructure, including Remote Hosts not operated by OakHost
• Software that customers install on their hosted Macs, and macOS itself (report macOS issues to Apple)
• Data center and network infrastructure operated by our providers (report to them directly)
• Findings without a security impact, such as missing best-practice headers, version disclosure, or self-XSS
• Findings that require social engineering, phishing, or physical access to OakHost staff or premises

3. How to report

Email security@oakhost.com. This is OakHost's single point of contact for vulnerability reports. We read reports in English and German.

Please include:

1. The affected product and version, and your operating system and version
2. A description of the vulnerability and its potential impact
3. Steps to reproduce, or a proof of concept
4. Whether you believe it is being actively exploited
5. How you would like to be credited, if at all

Sending sensitive details. We do not offer PGP encryption. If your report includes exploit code, credentials, or personal data, first send a short email without those details. We will reply within 2 business days with a link to a private, TLS-protected upload location that expires after use. Never include data belonging to other OakHost customers in a report.

You may report anonymously. If you do, we cannot send you status updates or credit you.

4. What happens after you report

We rate severity with CVSS v4.0 and take into account how the products are actually deployed. Our target times to release a security update, counted from confirmation:

An actively exploited vulnerability is handled immediately, regardless of score. If we cannot meet a target, we tell you why and agree on a new date with you. If we decide a report is not a vulnerability, we explain our reasoning, and you may ask us to reconsider.

5. Coordinated disclosure and advisories

We ask you to keep a vulnerability confidential until a fix is available, or until 90 days after your report, whichever comes first. We will agree on the publication date with you. If a vulnerability is already public or being actively exploited, we may publish earlier to protect users.

Once a security update is available, we publish a security advisory in section 11 of this page containing:

• A description of the vulnerability
• Affected products and versions, and the fixed version
• Its impact and CVSS v4.0 severity
• What users need to do, including workarounds where a fix cannot be applied immediately
• Credit to the reporter, if wanted

In exceptional cases we may delay publication of technical details for a short period after the update ships, so users have time to install it. We request a CVE ID for every confirmed vulnerability in an in-scope product through an appropriate CVE Numbering Authority.

6. Testing rules and safe harbor

When researching vulnerabilities, you must:

1. Test only on your own devices, your own installations of the products, and OakHost servers rented under your own account
2. Not access, modify, delete or retain data belonging to anyone else. If you come across such data, stop, report it, and delete any copies
3. Not run denial-of-service or load tests, or high-volume automated scans, against OakHost infrastructure
4. Not move from a vulnerability to other systems, Macs or customers
5. Not disclose the vulnerability before the coordinated date in section 5
6. Comply with applicable law

For good-faith research under these rules, you may decompile, disassemble and analyze OakConnect and OakHost Agent. This permission takes precedence over any contrary restriction in the products' license agreements.

If you follow this policy, OakHost will consider your research authorized, will not take legal action against you or file a complaint with the authorities, and will say so if a third party takes action against you over research covered by this policy. We cannot authorize testing of systems belonging to third parties, including other providers' hosts.

7. Reporting to authorities and informing users

Under Article 14 of the Cyber Resilience Act, OakHost notifies actively exploited vulnerabilities and severe incidents affecting the security of OakConnect or OakHost Agent. Notifications go through ENISA's Single Reporting Platform to the CSIRT designated as coordinator, which for OakHost is CERT-EE at the Estonian Information System Authority (RIA).

These notifications may include technical details from your report. We do not share your identity with authorities without your consent, unless required by law.

Under Article 14(8), we inform affected users of an actively exploited vulnerability or severe incident and of the measures they can take. We notify affected customers directly first, by email and in-app notice. Broader publication in section 11 follows once the issue has been addressed.

8. Third-party components

OakHost maintains a software bill of materials (SBOM) in a machine-readable format for each product, covering at least top-level dependencies, and monitors those components for known vulnerabilities.

If a vulnerability lies in a third-party or open-source component, we report it to the component's maintainer, share the fix with them if we develop one, and still remediate it in our products. If you report a vulnerability in a component we use, we may forward the relevant details to its maintainer and will tell you when we do.

9. Support periods and security updates

During the support period, OakHost:

• Provides security updates free of charge
• Installs security updates automatically by default, with an option for users to switch this off
• Ships security updates separately from feature updates where technically feasible
• Keeps each security update available for at least 10 years after release, or for the rest of the support period if longer

We fix vulnerabilities in the latest version of each product. Users of older versions can update to the latest version free of charge. We notify users before a product's support period ends.

10. Recognition, your data, and changes

Recognition. OakHost does not run a paid bug bounty. With your permission, we credit you in the advisory.

Your personal data. We use your name and contact details only to handle your report, communicate with you, and credit you if you want. Details are in our privacy notice at https://www.oakhost.com/privacy.

Changes. We may update this policy. The current version is always at https://www.oakhost.com/security, and reports are handled under the version in force when we receive them.

11. Security advisories

No security advisories have been published yet.