Thermondo Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: true
source: https://www.thermondo.de/.well-known/security.txt
policy:
- https://github.com/thermondo/vulnerability-disclosure-policy
contact:
- security@thermondo.de
preferred_languages:
- en
- de
expires: '2026-12-31T22:59:00.000Z'
bug_bounty:
  present: true
  model: severity-based
  notes: >-
    Thermondo offers bounties for good-faith vulnerability disclosures scaled by
    severity. Low-quality, low-impact, or policy-violating disclosures are not
    eligible for bounty payments. Reports may be submitted anonymously; receipt
    is acknowledged within 3 business days when contact information is shared.
scope:
  in_scope:
  - '*.thermondo.de'
  excluded:
  - outdated TLS versions
  - missing HSTS headers
  - automated vulnerability reports without proof of concept
evidence:
- source: well-known/thermondo-security.txt
  kind: security.txt
- source: https://github.com/thermondo/vulnerability-disclosure-policy
  kind: disclosure-policy