Vulnerability Disclosure Policy

Last updated: 1 November 2026 · Version 2.0 · iqmeta GmbH

This English version is a convenience translation. In case of any discrepancy, the German version prevails.

1. Our commitment

The security of nextxch and of our customers' mail systems is our highest priority. We welcome reports from security researchers and handle them confidentially, quickly and transparently. This policy is also referenced in our security.txt (RFC 9116).

2. Scope

In scope:

The nextxch software in all supported versions (server, SMTP/IMAP/JMAP/DAV/WBXML protocols, Admin cockpit, Webmail, Encrypted File Share, installers and update mechanism).
The website nextxch.com including checkout, license and download endpoints.
The public demo and production mail system mail.nextxch.com (non-destructive testing only).

3. Out of scope

Denial-of-service and volumetric attacks, load or spam testing.
Social engineering, phishing or physical attacks against iqmeta staff or offices.
Reports from automated scanners without a demonstrated impact, missing best-practice headers without exploitability, clickjacking on pages without sensitive actions.
Vulnerabilities in third-party services (for example Stripe) or in end-of-life versions.
Customer installations of nextxch operated by third parties: please report to us, but do not test them without the operator's permission.

4. How to report

Send your report to security@nextxch.com (German or English). Please include: affected component and version, a description of the vulnerability and its impact, step-by-step reproduction (proof of concept), and your contact details for follow-up. If you require encrypted communication, ask for our current OpenPGP key in your first message; we will provide it immediately.

5. Response commitments

Step	Target
Acknowledgement of receipt	within 3 business days (usually within 24 hours)
Triage and severity assessment (CVSS)	within 10 business days
Fix for critical vulnerabilities	hotfix as fast as possible, target 7 days
Fix for other vulnerabilities	within 90 days
Status updates	at least every 14 days until resolution

6. Coordinated disclosure

We ask you to give us a reasonable time to fix the issue before public disclosure, normally 90 days from your report or until a fix has been released, whichever comes first. We will agree on the publication date with you, publish a security advisory in our release history, request a CVE where appropriate and credit you unless you prefer to remain anonymous.

7. Safe harbour

If you act in good faith and in accordance with this policy, we will consider your research authorised, will not initiate legal action against you (including under Sections 202a ff. StGB or copyright law regarding reverse engineering for security research) and will not file a complaint with law enforcement. Good faith means in particular: you only access data to the extent necessary to demonstrate the vulnerability, you do not modify or delete data, you do not degrade services, you immediately stop and report if you encounter personal data, and you keep the details confidential until coordinated disclosure. This safe harbour cannot bind third parties.

8. Recognition & hall of fame

We do not currently run a paid bug bounty program. Valid reports are acknowledged in the security advisory and on our Trust page (hall of fame) and, for significant findings, rewarded with nextxch merchandise or a complimentary license at our discretion.