Report a Vulnerability or Security Incident

All fields are optional — send us what you have. An incomplete report is still a report.

Your contact details

Please enter a valid e-mail address, or leave the field empty.

You do not have to identify yourself. Leave this field empty to report anonymously. Please note that we then have no way to reach you — we cannot ask follow-up questions, confirm a fix, or agree a disclosure date. A disposable address is perfectly acceptable. Your address is used solely to handle this report and is never published.

What is affected

A vulnerability is a weakness that could be exploited but has not necessarily caused harm yet. An incident is something that has already happened — unauthorized access, data exposure, or a disruption you have observed. Not sure? A best guess is fine; our PSIRT team confirms this during triage.

What did you find

Your classification above is an initial indication — the final severity and whether the issue is being exploited are determined by our PSIRT team during triage. What helps most here is technical detail: a CVSS score or vector if you have one, a CVE or EUVD identifier if assigned, relevant log excerpts, or anything indicating active exploitation.

Allowed file types: .txt, .log, .png, .jpg. Maximum total size: 25 MB across all files. Please remove unrelated personal or confidential data before uploading.

    Data protection

    Data protection notice (GDPR / DSGVO)

    Controller

    [Entity] GmbH, [Address], [Country] — contact: privacy@trench-group.com. Data Protection Officer: [DPO name / contact].

    Purpose and legal basis

    We process the data you submit here to assess, respond to and remediate the reported vulnerability or incident (Art. 6(1)(f) GDPR — legitimate interest in the security of our products), and, where the report falls within the scope of the EU Cyber Resilience Act (Regulation (EU) 2024/2847), to fulfil our legal reporting obligations to ENISA and the competent national CSIRT (Art. 6(1)(c) GDPR).

    Recipients

    Your data is shared with our internal Product Security Incident Response Team (PSIRT). Where legally required under the Cyber Resilience Act, relevant report content is shared with ENISA and/or the competent national CSIRT. Where necessary to investigate or remediate the issue, relevant technical details may be shared with third-party suppliers or component manufacturers whose products are affected. We do not share your data with any other third party, and never for marketing purposes.

    Public disclosure

    If a security advisory or CVE record is published about the issue you reported, it will not include your name, e-mail address or other personal data unless you explicitly ask to be credited and agree to that in writing.

    Data minimisation

    Please do not include personal data of other individuals (for example in logfiles or screenshots) unless it is strictly necessary to demonstrate the issue.

    Automated decision-making

    No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place based on this data.

    Retention

    We retain this data for as long as necessary to handle the report and to meet legal retention obligations, including CRA-related recordkeeping, after which it is deleted or anonymised.

    Your rights

    You have the right to access, rectify or erase your data, to restrict or object to processing, to data portability, and to lodge a complaint with a supervisory authority. Where processing is based on your consent, you may withdraw it at any time without affecting processing carried out before the withdrawal. Providing your contact details is voluntary, but necessary if you would like a response. Full details are in our privacy policy.

    We aim to acknowledge your report within five business days and to complete our internal analysis within ten business days.