Coordinated Vulnerability Disclosure Policy (CVD Policy)                    

Published by:

• Cofresco Frischhalteprodukte GmbH & Co. KG, Ringstr, 99, 32427 Minden, Germany
• fresh at work GmbH, Wullener Feld Witten, Germany
• Melitta Europa GmbH & Co. KG, Ringstr, 99, 32427 Minden, Germany
• Melitta Professional Coffee Solutions GmbH & Co. KG, Zechenstr. 60, 32429 Minden, Germany
• Melitta Single Portions GmbH & Co. KG, Ringstr, 99, 32427 Minden, Germany
• Roast Market GmbH, Stephanstr. 1, 60313 Frankfurt am Main, Germany

Last updated: September 11, 2026

As a whistleblower of security vulnerabilities, you make a decisive contribution to improving the security of digital products and infrastructures. This guideline for the coordinated disclosure of security vulnerabilities (CVD policy for short) is intended to ensure that your findings are handled appropriately and processed quickly. It describes how Melitta reacts to your reports, what assurances you can expect and which steps lead to a successful disclosure process.

           1 Scope of our CVD Policy – What do we mean by a valid security vulnerability?

For the purposes of this Policy, a "valid vulnerability" is defined as a vulnerability, bug, or security issue that directly affects the hardware or software of any of the Melitta Products and can be exploited.

To be considered a "valid security alert," the information disclosed must not already be in the public domain. This ensures that the alert provides new and actionable insights for the security process. In addition, alerts generated solely by automated tools or scans without sufficient accompanying documentation are not considered sufficient because they lack the necessary evidence to enable meaningful analysis and remediation of a valid vulnerability. Each alert should ideally include supporting details. This helps us focus on real issues and respond faster.

           2 How to report a vulnerability – reporting channels

If you discover a security vulnerability, please submit a report through one of the following channels.

• Email: You can send us an email to psirt@melitta-group.com , unencrypted or encrypted and digitally signed.
  
  

• Web form: We provide a secure web form on our vulnerability disclosure website: www.melitta-group.com/product-security. This form supports anonymous reporting. You don't need to provide any personal information to submit a report. The web form is available in English and will guide you through entering the most important details we need.
  
  

• Security.txt: On our website, we maintain a "www.melitta-group.com/.well-known/security.txt." file that lists our contacts and preferences for vulnerability disclosure. Whistleblowers can view this file for up-to-date information on how to reach us.

Please provide as many technical details as possible when submitting a report. This will help us assess and resolve the issue more quickly. We recommend that you provide the following:

• A description of the vulnerability and its potential impact. What could an attacker achieve? What aspects of confidentiality, integrity, and availability are at risk?

• Specific names, versions and configurations of the affected products. (For websites or services, please include URLs or IP addresses; for hardware or software, please include model or version numbers).
  
  

• Steps to reproduce of the problem – such as which commands, inputs, or actions trigger the vulnerability. Screenshots or proof-of-concept (PoC) code are very helpful.
  
  

• If known, suggestions on how to fix it or hints at fixes (optional, but welcome).
  
  

• Your contact details (name or pseudonym) in case you would like a reply. Alternatively, you can submit a report anonymously.

•  

  We may reach out to you with questions to better understand the reported vulnerability or ask for reproducible technical artifacts and instructions so that the vulnerability can be reproduced and fixed.

   

  Anonymous report: You can voluntarily provide contact details for further communication. However, this is not mandatory. You can use our web-based form for anonymous reports, as we respect your desire for anonymity. Please note that anonymous reports can only be processed to a limited extent or possibly not at all, as there is no possibility to ask technical or content-related questions, especially in the case of complex security vulnerabilities.

   

             3 What we expect from you – Code of Conduct

   

  We expect whistleblowers to adhere to appropriate standards of integrity and responsible behavior when identifying and reporting vulnerabilities. Therefore, we do not tolerate the following behaviors:

   

  • No malicious or malicious testing: Whistleblowers may only perform tests that do not disrupt operations. A proof-of-concept is required to confirm the existence of a vulnerability. The proof-of-concept must not intentionally compromise user data, disrupt services, or damage systems.

   

  • No exploitation beyond testing: Active exploitation of a vulnerability beyond initial proof-of-concept testing is strictly prohibited. In particular, do not abuse the vulnerability to compromise data, change configurations, access other systems, or access our systems permanently. It is sufficient to trigger the problem to prove its existence – for example, do not download more data than is necessary to prove the vulnerability. If you come across sensitive information (e.g., user personal information, copyrighted material, trade secrets), cancel the test, report it to us immediately, do not share this information, and do not retain it.

   

  • No social engineering or physical attacks: Do not use social engineering techniques (phishing emails, phone pretexting, etc.) against our employees or systems, and do not conduct physical security tests (such as attempting to break into our offices or data centers). This policy is limited to technical vulnerabilities in our products and infrastructure and excludes social and physical attack vectors.

   

  • No denial-of-service or "brute-force" attacks: Do not conduct DoS/DDoS attacks or tests that could affect the availability of our services to users, nor do we conduct "brute-force" attacks. We want to avoid any disruption to our customers.

   

  • No attacks on third parties or public systems: Don't target vulnerabilities in third-party services or products we use. Instead, notify the vendors directly. Also, don't test systems that we don't own or operate.
  If you accidentally access other parties' data or systems during your research, notify us and stop taking further action. Do not compromise or manipulate third-party data during your research.

   

  • No Breach of Confidentiality or Use of Information: Whistleblowers are required to keep details of security vulnerabilities confidential and may not publicly disclose, sell, or otherwise distribute exploit code or technical details that would allow exploitation until Melitta has published a public safety notice or otherwise authorized the disclosure. This does not prevent the whistleblower from notifying competent authorities, the national CSIRT, or law enforcement agencies if required to do so by law or if immediate disclosure is required to prevent imminent harm.
    
    

  • No unreasonable processing time: Melitta shall be given a reasonable, severity-based period of time to investigate, remediate, and distribute security updates. If Melitta fails to remediate the vulnerability within a reasonable 3-month period or provide a credible remedial action, the whistleblower may notify a national CSIRT or competent authority.

   

             4 Our Commitment to Whistleblowers When Reporting a Security Vulnerability

   

  All incoming reports will be processed to the best of our knowledge and belief. In the case of anonymous reports, we cannot respond to the whistleblower, but we will of course still carry out the investigation. If you have indicated a contact option, the following applies:

   

  • Answer: After you submit a security report to us, we will acknowledge receipt within five business days. Within 15 business days of receipt, we will provide feedback on whether we confirm or reject the reported vulnerability. If we need clarifications or additional information, we will ask to better understand the reported vulnerability or explain to you to a reasonable extent why the investigation of the reported vulnerability is ongoing. We are not required to disclose our own findings to the whistleblower in detail or explain our motivations.
    
    
  • Confidentiality of communication: To the extent permitted by law, we will ensure that any security report received is kept confidential and that your personal information is not shared with third parties without your explicit consent. Information necessary for the public disclosure of the validated and verified vulnerability will be published to the extent that we are legally required to do so.
    
    
  • Respectful and Open Communication: We will conduct communication professionally and respectfully. We expect the same courtesy in return. We show zero tolerance for disrespect, discrimination, harassment or threats and will immediately stop communication in the event of such tendencies.

   

             5 Coordination and completion of disclosure

   

  Validated and verified vulnerabilities are publicly disclosed by Melitta on the European Vulnerability Database and under www.melitta-group.com/de/product-security . The public disclosure includes:

   

  • A description of the vulnerability.
    
    
  • Information that allows users to identify affected products/versions.
     
  • The impact and severity.
     
  • Clear instructions on how to apply remedies or a patch.

   

  We consider a CVD process to be completed when one of the following occurs:

   

  • A correction or remedy has been provided and a public safety notice has been published, or
    
    
  • it has been determined that the reported issue is not a security vulnerability (false positive or out of scope) and this has been communicated to the whistleblower or
    
    
  • we cannot reproduce the problem or need more information and the whistleblower has not responded for an extended period of time (usually 30 days); in this case, we will close the case until new information is available.

   

  We will notify the whistleblower of the end of the CVD process, unless the vulnerability was reported anonymously.

   

             6 Legal Disclaimer

   

  By complying with this CVD Policy, Melitta acknowledges that the whistleblower is acting in "good faith" and will not take any criminal action against the whistleblower in connection with its vulnerability disclosure activities.