Write to sven.nickel@gmail.com. Every report gets read, including the ones that turn out to be harmless.
Coordinated vulnerability disclosure policy
I acknowledge receipt within 72 hours.
I come back with a first assessment within 14 days — even if that assessment is that I cannot say yet.
I ask for 90 days before publication so that a fix can reach users. If the flaw is being actively exploited, that deadline does not apply — then speed is what counts.
Anyone who reports responsibly will be credited on request. No legal action will be taken over good-faith security research.
Support period
Security updates are provided until 2031-09-19 (at least five years from the placing on the market of the respective version).
An electronically signed version of the declaration is available on request via the address above.
Manufacturer
Sven Carsten Nickel (ÆquiNode Studio) Nedlitzer Str. 7, 14612 Falkensee, Germany
Product
Heftig – Schulplaner (studio.aequinode.heftig)
Conformity assessment
Module A — internal control (Annex VIII Part I)
Software bill of materials
A bill of materials in CycloneDX 1.6 format is kept current and forms part of the technical documentation. Market surveillance authorities receive it on request via the address above.