Report a security vulnerability
Coordinated Vulnerability Disclosure at kaptura GmbH – central reporting page
Found a vulnerability in a product or in the infrastructure of kaptura GmbH? Please report it to us confidentially. We handle every report and we get back to you.
Our commitments, in short
A non-automated acknowledgement within 5 working days and detailed feedback within 10 working days. We do not require a non-disclosure agreement, and we will not pursue criminal charges as long as you act in accordance with our CVD policy.
1. Where to report
| Responsibility | Address |
|---|---|
| PSIRT products and services |
psirt@cvd.kaptura.de |
| CSIRT infrastructure and operations |
csirt@cvd.kaptura.de |
If in doubt, use PSIRT. We forward internally.
2. Reporting confidentially
We recommend transmitting confidential information encrypted and digitally signed. Each address has its own key:
- psirt@cvd.kaptura.de
- https://cvd.kaptura.de/pgp/psirt.asc
C912 8546 45F1 0322 A3EA B745 3864 3017 5B9A 314E- csirt@cvd.kaptura.de
- https://cvd.kaptura.de/pgp/csirt.asc
74AB 9AD8 556A 29B5 E6A6 C2E8 0699 A887 151E 0FA5
Both RSA 4096, valid until 2029-09-08. Please verify the fingerprint before you encrypt – ideally through a channel other than this page.
3. Verifying that this page is genuine
Our machine-readable contact information follows RFC 9116 and lives at /.well-known/security.txt. It is signed with a dedicated signing key that exists for that purpose alone and never decrypts mail:
- Signing key
- https://cvd.kaptura.de/pgp/txtsign.asc
78E5 512A 45D8 AC0D 548C 80BB 6AB4 CA9A 9D9E 3091
This key cannot encrypt. For reports, please use one of the two contact keys above.
The file is also reachable via
https://kaptura.de/.well-known/security.txt.
4. What helps us
Please include, where available:
- affected product and version
- affected component
- description of the vulnerability
- steps required to reproduce the issue
- proof of concept or other technical evidence
- potential impact
- relevant logs or screenshots
- whether exploitation has been observed
- how we can best reach you
Please send only what is necessary to investigate. We accept email addresses and telephone numbers as contact options. Status enquiries are explicitly welcome.
5. Reporting anonymously
You can report through the form below without giving any contact details. No account, no login, no JavaScript. Your report is encrypted the moment it is received, using the OpenPGP key published above.
What we see, and what we do not
We do not log your IP address or your browser. The service that receives the form collects neither; your address is only briefly hashed for abuse protection and is never written anywhere.
The platform operator does see it briefly. The endpoint runs at a German provider whose router records the source address of every request. We cannot switch that off, so we say it rather than conceal it. If that is too much for you, write to us encrypted by email – there a provider sees only the transport.
6. Privacy
We treat every report confidentially to the extent permitted by law, and we will not disclose personal data to third parties without your explicit consent unless required to do so by law. Access is limited to the people who need the information to handle the report.
If you give us contact details, we process them solely to handle your report. You may leave them out – see section 5. Our privacy policy covers the rest.
7. Full terms
Scope, response times, disclosure, safe harbour and the conditions under which we close a case are set out in our Coordinated Vulnerability Disclosure Policy. Please read it before reporting. It is published here, on this domain, and needs no account to read.
Validity
These contact options are valid until 2027-09-08 and are reviewed at least annually. This page was last updated 2026-09-10.