Security & Responsible Disclosure

We take the security of Perimea seriously. If you believe you have found a security vulnerability in our products or services, we would like to hear from you. This page describes our channel for coordinated vulnerability disclosure (including within the meaning of Regulation (EU) 2024/2847, the Cyber Resilience Act).

Manufacturer

How to report

Please email your report to security@perimea.app. The same information is available in machine-readable form at /.well-known/security.txt (RFC 9116). We handle reports in English and German.

Helpful details:

• affected product and version (e.g. Perimea iOS 2.3, Perimea Desk 1.0.1) or URL,
• a description of the vulnerability and its potential impact,
• steps to reproduce or a proof of concept,
• how we can reach you and whether you would like to be credited.

Please do not include real customer data. If you need an encrypted channel, we are happy to set one up after your first contact.

Our commitments

• Acknowledgement of receipt within 72 hours.
• An initial assessment and regular updates on remediation progress.
• Coordinated disclosure: please publish details only once a fix is available, and no later than 90 days after your report — unless agreed otherwise.
• On request, we credit you in the release notes or security advisory.
• No legal action against good-faith researchers: if you act in good faith within this policy, we will not pursue civil or criminal action against you.

Scope

• Perimea apps for iOS, iPadOS and macOS,
• Perimea app for Android,
• Perimea Desk (Windows/macOS),
• the website perimea.app, including our licensing and download services.

Out of scope: denial-of-service and load testing, social engineering, phishing, physical attacks and third-party services (e.g. App Store, Google Play, payment and hosting providers) — please report those directly to the respective provider.

Ground rules

• Access data only as far as necessary to demonstrate the issue, and delete it afterwards.
• Do not impair the availability of our services or other users' data.
• Give us reasonable time to fix the issue before sharing information.

We do not currently run a paid bug bounty programme.