Security

Report a vulnerability

Found a security flaw in AnnexCREATE? Please report it to us before making it public. We take every report seriously, and a human answers it.

How to report

• By email to mail@annexcreate.com, subject "Vulnerability". German or English.
• The same contact is published in machine-readable form in our security.txt (RFC 9116).
• We do not currently offer encrypted reporting and do not publish a PGP key. Please do not send credentials or third-party data.

What to include

• The affected app and version (AnnexHub, AnnexDesign, …) and your macOS version, or the affected address on the website.
• What you observed and what impact you suspect.
• Steps to reproduce, ideally with a small sample file.
• Whether you know the flaw is already being exploited.
• How we should credit you, or that you wish to remain anonymous.

What we ask you not to do

• No tests against accounts, licences or data of other customers. Test only your own installation and your own files.
• No load, stress or denial-of-service tests against annexcreate.com and our interfaces.
• No social engineering against us or third parties, and no access to data beyond what is needed to demonstrate the flaw.
• Please publish details only after agreeing a date with us.

Our response times

We are a small team. These are the times we commit to and keep:

• Acknowledgement: within three working days, with a case number.
• First assessment: within five working days: whether this is a vulnerability in AnnexCREATE and how severe it is (CVSS severity). If we suspect it is already being exploited, we assess it within 24 hours.
• Fix: critical and high vulnerabilities without undue delay, as a guideline within 14 days of assessment; medium ones with the next version; low ones as planned. If we need more time, we tell you why.
• Feedback: you learn the outcome and the publication date.

Actively exploited vulnerabilities are also reported by us to the competent authorities, as Regulation (EU) 2024/2847 (Cyber Resilience Act) requires.

Coordinated disclosure

We ask you to keep the matter confidential until an update is available, generally for no more than 90 days from receipt of your report. Actively exploited flaws are fixed and reported faster. After the fix we publish a description, affected versions, severity, the fixing version and advice on what to do, in the release notes and on this website. We name you as the reporter if you wish. If the cause lies in a third-party library, we pass your report on to its maintainer.

Safe harbour

If you follow this policy, that is, act in good faith, only on your own installation, without taking third-party data and without obstructing us, we will not take legal action against you and will not report you. This covers our own claims; we cannot make promises on behalf of third parties. There is currently no bug bounty programme.

Security updates for at least five years

For every licence we provide security updates free of charge for at least five years from the date of purchase, even if a new major version is released in that time (Terms, section B4). We distribute updates signed, through the apps' update feed and the downloads page.

As of September 2026. Contact details in machine-readable form: /.well-known/security.txt.