Report a Vulnerability

Last updated: October 22, 2026 · Version 1.0

If you have found a security vulnerability in PawWeather, please let us know. We are happy to work with you on a coordinated fix.

Manufacturer: MDDX Digital Solutions UG (haftungsbeschränkt), Eichholzstraße 20a, 45475 Mülheim an der Ruhr, Germany

How to reach us

Email: [email protected], optionally encrypted with our OpenPGP key (fingerprint C8C5 5651 D26E B1CB F32F 9E10 0183 3B99 CD5E 56F4)
Phone: +49 208 7578003 (Germany), business days 9 am–5 pm CET
Mail: to the address above, marked “Security”

We reply in English or German. Please include the affected product and version, a description and its impact, steps to reproduce without real user data, and whether you would like to be credited.

Scope

the PawWeather apps for iOS and Android
this website and the services under pawweather.app

Out of scope: third-party services (such as app stores or weather providers), denial-of-service testing, social engineering, physical attacks, and automated scanner output without a demonstrated attack path.

What to expect

Acknowledgement within 3 business days
Initial assessment within 10 business days
Status updates at least every 14 days
Target fix times: critical 7 days, high 30 days, medium 90 days, low in the next regular update
Coordinated disclosure once a fix is available, by default no later than 90 days after your report

Security updates are free of charge. Actively exploited vulnerabilities are reported to the German Federal Office for Information Security (BSI, CERT-Bund) and ENISA under the EU Cyber Resilience Act (Regulation (EU) 2024/2847).

Safe harbor

Please access only the data needed to demonstrate the issue, do not modify or delete data, do not disrupt the service, and keep details confidential until a fix is available or disclosure has been agreed.

If you act in good faith and within this policy, we will not take legal action against you or file a criminal complaint. This commitment binds only us. We do not run a bug bounty program, but we are happy to credit you publicly. We use your contact details only to handle your report, see our Privacy Policy.