How to report a suspected security issue on our websites and online services, and what to expect from us.
KNX Association takes the security of its websites, tools and services seriously. If you believe you have found a security vulnerability, we encourage you to report it to us responsibly.
How to report
Send your report to vulnerabilities[at]knx.org. This is also the contact listed in our security.txt file on website. Please include:
- A clear description of the issue and the affected URL, system or service.
- Step-by-step instructions to reproduce it.
- A proof of concept or evidence showing the real impact (for example, screenshots or request/response samples).
- Your contact details, so we can follow up with you.
Our reward policy
KNX Association does not operate a bug bounty programme, and submitting a report does not entitle you to a reward. We do not pay rewards for hardening recommendations or findings from automated scanners, such as:
- Missing or misconfigured HTTP security headers (for example CSP, Referrer-Policy or Permissions-Policy) without a demonstrated exploit.
- Results from automated scanning tools without manual verification.
- Theoretical issues that depend on other, unproven vulnerabilities.
- Best-practice suggestions (for example, SPF/DMARC settings or banner disclosure) with no demonstrated impact.
At our sole discretion, we may consider a reward only where a report proves a real, exploitable vulnerability with a demonstrable impact on our systems or users. Any such decision is made after our review and cannot be promised in advance. Requests for payment made before we have reviewed a report, or as a condition of disclosure, will not be considered.
Rules for researchers
Please act in good faith and:
- Do not access, change or delete data that is not yours, and stop as soon as you have proven the issue.
- Do not carry out actions that could disrupt our services, such as denial-of-service testing, spam or social engineering of our staff or members.
- Do not disclose the issue publicly until we have had a reasonable opportunity to investigate and fix it.
What to expect from us
We will review your report, may contact you for more information, and will address confirmed issues as appropriate. Because of the volume of reports we receive, we may not be able to reply individually to every submission.