Eon Next Vulnerability Disclosure

generated: '2026-07-27'
method: searched
probe: true
source: https://www.eonnext.com/.well-known/security.txt
description: >-
  E.ON Next's vulnerability-reporting channel is the E.ON group one, published as
  a PGP-signed RFC 9116 security.txt and served identically from
  www.eonnext.com, eonnext.com and the parent site www.eon.com. It is a contact,
  not a programme: the file carries Contact, Expires, Encryption and
  Preferred-Languages, and no Policy, Acknowledgments or CSAF field. No bug
  bounty (HackerOne, Bugcrowd, Intigriti) was found under E.ON, E.ON Next or
  eonnext.com, and the group's own security pages on www.eon.com answer HTTP 403
  to every machine client, so no safe-harbour terms could be read.
policy: []
policy_note: >-
  No Policy: field in security.txt and no responsible-disclosure page located on
  any eonnext.com host — the 414-URL sitemap contains no /security or
  /responsible-disclosure path.
contact:
- mailto:security@eon.com
encryption: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xf6f9fb4d40f95f470d9cebfc477ba6dcfd27aece
expires: '2026-12-31T22:59:00.000Z'
preferred_languages: [en, de]
signed: true
bug_bounty: false
bug_bounty_note: No HackerOne, Bugcrowd or Intigriti programme found for E.ON or E.ON Next.
safe_harbour:
  stated: false
  detail: No disclosure policy or safe-harbour language is published in machine- or human-readable form.
evidence:
- source: https://www.eonnext.com/.well-known/security.txt
  kind: security.txt
  http_status: 200
  file: well-known/eon-next-security.txt
  date: '2026-07-27'
- source: https://eonnext.com/.well-known/security.txt
  kind: security.txt
  http_status: 200
  note: identical document on the apex domain
- source: https://www.eon.com/.well-known/security.txt
  kind: security.txt
  http_status: 200
  note: byte-identical group-level document — the contact is E.ON SE, not E.ON Next specifically
- source: https://www.eon.com/en/about-us/cyber-security.html
  kind: corporate-security-page
  http_status: 403
  note: group site denies machine clients; substance could not be read
probes_run:
  script: 0-working/probe-security-programs.py
  result: 'vdp=written trust=none'