Coordinated Vulnerability Disclosure Policy (CVD Policy)

Actifsource AG accepts reports of vulnerabilities in its products. We assess and fix reported vulnerabilities and disclose them in a coordinated manner.

Scope

Out of scope:

• Visual Studio Code, the Visual Studio Marketplace, the Eclipse IDE and other third-party products. Please report these to the respective manufacturer.
• Vulnerabilities in third-party components that cannot be exploited through our product.

Reporting channel

Email to info@actifsource.com, with the subject starting with “Security:”.

Please do not report vulnerabilities publicly, e.g. not in public issue trackers or forums. On request, we will agree on a confidential channel for submitting your report.

Languages: German or English.

Helpful information:

• affected product and version
• version of Visual Studio Code or Eclipse and operating system
• description of the vulnerability and its impact
• steps to reproduce

Our response

• We acknowledge receipt of your report promptly.
• We assess the report and share our assessment with you as soon as it is available.
• We fix confirmed vulnerabilities without delay. The urgency depends on the severity.

Disclosure

• Once a fix has been released, we publish information on the fixed vulnerability in a security advisory.
• In justified cases, we postpone publication until users have been able to install the update.
• We inform the reporter before publication.
• Please do not publish any details before we have published the advisory.
• Advisories: https://www.actifsource.com/documentation/manual/security/20-advisories/

Reporting to authorities

If a vulnerability in our product is actively exploited, we report it to the competent authorities in accordance with Art. 14 of Regulation (EU) 2024/2847 and inform the affected users.