Heidelberg Instruments PSIRT
The Heidelberg Instruments Product Security Incident Response Team (PSIRT) is the central point of contact for security researchers, customers, partners, and other stakeholders who wish to report potential security vulnerabilities affecting Heidelberg Instruments products, software, or systems.
We welcome responsible disclosure and appreciate the efforts of security researchers who help us identify and address vulnerabilities. Our goal is to assess reported vulnerabilities promptly, develop appropriate remediation measures, and help protect our customers and products.
For vulnerability reports and security-related inquiries, please contact:
psirt_himt@heidelberg-instruments.com
Tel.: +49 6221 728899 0
Reports may be submitted in English or German. For confidential communication, we recommend using PGP encryption.
What should be reported?
Please contact the Heidelberg Instruments PSIRT if you believe you have identified a security vulnerability affecting:
- Heidelberg Instruments products and hardware systems within their official support lifecycle
- Firmware-based control components
- Software or other components associated with Heidelberg Instruments products
- IT infrastructure officially operated under the heidelberg-instruments.com domain
The policy does not cover third-party IT systems, cloud services, or software operated by suppliers or partners, nor the physical security of Heidelberg Instruments facilities.
How to report a vulnerability?
Please send your report to:
psirt_himt@heidelberg-instruments.com
To help us assess and process your report efficiently, please provide as much of the following information as possible:
Reporter information
Your name and contact details. You may report anonymously if you prefer.
Affected product or component
Please include the product family, model, component, serial number, software version, firmware version, or other relevant identifying information, where available.
Description of the vulnerability
Describe the security issue and how it can be reproduced.
Proof of concept or technical evidence
Where available, please provide proof-of-concept code, network traces such as PCAP files, screenshots, logs, or a detailed description of how the vulnerability can be triggered.
Potential impact
Please describe the potential or observed impact and indicate whether you believe the vulnerability is actively being exploited.
Disclosure status
Please let us know whether the vulnerability has already been disclosed publicly or whether you are planning to disclose it.
These details correspond closely to the information requested by our Vulnerability Disclosure Policy.
What happens after you report?
We aim to handle vulnerability reports transparently and keep reporters informed throughout the process.
1. Acknowledgement
The Heidelberg Instruments PSIRT will acknowledge receipt of a new vulnerability report within two business days.
2. Initial assessment
Within a maximum of one week after acknowledgement, we will provide an initial substantive response regarding the validation of the reported vulnerability.
3. Analysis and remediation
We assess the reported issue, determine its relevance and potential impact, and coordinate with the responsible development and product teams to identify and prioritize appropriate remediation measures. These may include security fixes, software updates, configuration changes, or other mitigations.
4. Status updates
We provide regular updates on the progress of the report and, in any event, no less frequently than every two weeks.
5. Security advisory
Once a vulnerability has been successfully validated and the effectiveness and compatibility of the remediation have been established, Heidelberg Instruments may publish a Security Advisory together with the relevant patches, updates, or recommended actions. Where appropriate, reporters may be acknowledged in the advisory upon request.
Coordinated disclosure and safe harbor
Heidelberg Instruments supports responsible and coordinated disclosure of security vulnerabilities.
Security researchers conducting vulnerability research in good faith and in accordance with our Vulnerability Disclosure Policy are covered by our Safe Harbor provisions. Among other requirements, researchers must limit their activities to security research and reporting, protect the confidentiality and availability of systems and data, avoid disruptive activities, and refrain from public disclosure for at least 90 days after Heidelberg Instruments receives a complete and reproducible report, unless Heidelberg Instruments agrees otherwise in writing.
Please review the full Vulnerability Disclosure Policy before conducting security research against Heidelberg Instruments systems.
Encryption and PGP
We strongly encourage the use of encryption when submitting sensitive vulnerability information.
HIMT PSIRT PGP Public Key
Fingerprint: BC07 98DB DE4F A932 DFDF 97C5 F126 7A4B 57A7
For maximum protection of sensitive information, please encrypt your report and any supporting files with the HIMT PSIRT public key before sending them by email.
Privacy
Personal information submitted as part of a vulnerability report, such as your name, contact details, and organizational affiliation, is processed by Heidelberg Instruments for the purpose of handling the report and communicating with the reporting individual.
Further information about data processing, retention, and data subject rights is available in our Privacy Policy.
