Report a vulnerability: coordinated disclosure.
We take the security of RAGSuite seriously. If you have found a vulnerability in RAGSuite or on ragsuite.de, we want to hear about it, and work with you to fix it. Write to security@ragsuite.de.
security@ragsuite.de · security.txt per RFC 9116
Tell us what you found.
Write privately
To security@ragsuite.de: please no public issue on GitHub.
Give details
Component and version, environment, steps to reproduce and the impact.
Give us time
Give us reasonable time to fix it before you publish anything.
What a helpful report contains.
Component and version
Which edition, which version, which part, such as API, widget or connector.
Steps to reproduce
Precise enough for us to reproduce the behaviour ourselves.
Impact
What an attacker could achieve and under which conditions.
What you can expect from us.
We acknowledge your report within 3 working days and give a first assessment within 10 working days. We keep you updated until the fix, publish a security advisory once a correction is available and credit you there if you wish. We treat your report confidentially and do not share your details without your consent.
For actively exploited vulnerabilities and severe security incidents we meet the reporting obligations under the Cyber Resilience Act that apply since 11 September 2026.
What is in scope, and what is not.
| In scope | Out of scope |
|---|---|
| The RAGSuite software (Community and Enterprise) | Third-party services we do not operate |
| RAGSuite Engine | Social engineering and physical attacks |
| The website ragsuite.de | Volumetric denial-of-service attacks |
| Automated scanner output with no demonstrated impact |
Good-faith research is welcome.
We will not take legal action against good-faith research that respects this policy: do not violate privacy, do not disrupt services, do not access data beyond a minimal proof of concept and test only against your own installation. In the RAGSuite Engine, please test only with your own account. If in doubt, ask us first at security@ragsuite.de. This commitment covers everything in the scope above.
Reporting a vulnerability: your questions.
Is there a bug bounty programme?
Not at the moment. We thank you for valid reports by crediting you in the security advisory if you wish. We are considering a bug bounty programme for the future. Please report vulnerabilities anyway, even small ones, every report helps make RAGSuite safer for all users.
May I test in the RAGSuite Engine?
Yes, but only with your own account and without accessing other customers’ data or disrupting the service. Please agree load tests and automated scans against the cloud with us in advance. For extensive tests we recommend your own installation of the Community Edition.
Where can I find the security.txt?
At ragsuite.de/.well-known/security.txt per RFC 9116. It lists the contact, preferred languages and the link to this policy. We keep the file current and renew its expiry date regularly. We accept reports in German and English. Please always use the address given there, security@ragsuite.de, for reports.
What if I get no reply?
If you receive no acknowledgement within 3 working days, please write again to security@ragsuite.de and also to info@ragsuite.de with the subject “Security”. That way no report gets lost. Please do not publish the vulnerability before we have had a chance to respond.
What happens after the fix?
As soon as a fix is available, we publish a security advisory with a description, affected versions and a recommendation. If you wish, we credit you there as the finder. We also inform Enterprise Edition and RAGSuite Engine customers directly if they are affected.
What does not count as a vulnerability?
Out of scope are third-party services, social engineering, physical attacks, volumetric denial-of-service attacks and automated scanner output with no demonstrated impact. We are glad to look at missing headers or findings without a concrete attack scenario, but do not treat them as security incidents. If in doubt, report it anyway.
Questions about RAGSuite security?
In the Trust Center you find operations, encryption and security reviews. For documents, talk to us.