# Schmitz Cargobull Vulnerability Reporting Policy and Guideline 

## Intro

Security of our digital services and products is a key topic at Schmitz Cargobull. It is our goal to identify and eliminate potential vulnerabilities as quickly as possible. We do appreciate sincere information and analyses from external sources pointing at potential vulnerabilities of our products and services. Confidentially reported vulnerabilities are handled according to the principles of Coordinated Vulnerability Disclosure (CVD) for evaluation, assessment and execution of potential corrective measures.
Schmitz Cargobull offers a bug bounty program for reported bugs via YesWeHack! with focus on IT-Services.

## Scope

This guideline explains how to report potential cybersecurity vulnerabilities in Schmitz Cargobull products and services. Please note that we do not authorize activities that harm users or others by compromising the safety or security of our products or the confidentiality, integrity, or availability of any data or services.

## How to report a vulnerability

Please send your observations and results to the following address of the Schmitz Cargobull Security Team (CERT).

cert@cargobull.com  

## Encryption

If you would like to encrypt your email, you can use our public OpenPGP key.

https://www.cargobull.com/.well-known/cargobull_cert_public_key.asc

## How to structure the report

In order to support the processing at Schmitz Cargobull, your report should include the following information:
-	Your contact data (name, phone number, organization (if applicable))
-	In case of a vehicle related vulnerability: available information about the system where the vulnerability was detected (e.g. VIN, description of the component, version and part number)
-	In case of an IT system or portal related vulnerability, please include the URL or IP address
- 	In case of a mobile or desktop application, please include the name, version and platform
-	Describe how the vulnerability was detected and include known technical details
-	The initial report shall not have any attachments to avoid that it might be handled as spam by our email system. (In the subsequent exchange with our CERT, we will offer file exchange options if needed)

## Language

Our preferred languages are German or English.

## Principles to consider

Always obey the following principles when investigating a potential vulnerability:
-	Do not manipulate or tamper with any safety critical vehicle system
-	Avoid harm to yourself or others
-	Do not misuse any personal data which was obtained while investigating the vulnerability
-	Do not perform tests while driving in public areas.
-	Only perform legal activities
-	Respect property rights. Only work on your own vehicles or with permission of the owner
-	Do not alter or change data you might get access to
-	Confidentiality, Integrity, and Availability of data and services are our key concerns

## What happens after the initial reporting

Your vulnerability report will be read and categorized and answered with an acknowledgement by our CERT. Our team will then thoroughly evaluate, analyze and verify the provided information. It will stay in contact with you in case of further questions. Once the investigation is completed and the further course of action is decided, you will receive a final feedback.

## Handling of your personal data

We will store the personal data which was provided in the context of the reporting in alignment with regulatory requirements and GDPR principles.   

## Disclosure

Please refrain from going public with your findings until Schmitz Cargobull has concluded the investigation.

## Creation Date

August, 1st 2026 (2026-08-01)