Product Security

MARSIG mbH takes the security of its products seriously. This page is the single point of contact for all security matters concerning MARSIG products, in accordance with the EU Cyber Resilience Act (Regulation (EU) 2024/2847). It explains how to report a vulnerability, how we handle reports and where we publish security advisories.

Report a vulnerability

If you believe you have found a security vulnerability in a MARSIG product or service, please tell us. Choose whichever channel suits you:

  • E-mail: security@marsig.com
  • Phone: +49 (0)381 66096400 (Monday to Friday, office hours)
  • Post: MARSIG mbH, Product Security, Fischerweg 408, 18069 Rostock, Germany

We accept reports in English and German. Please include as much of the following as you can:

  • the affected product, component and version (for example searecs onboard software 2.x, searecsCLOUD, Service Portal)
  • a description of the vulnerability and its possible impact
  • the steps needed to reproduce it, ideally with a proof of concept
  • how we can reach you for questions

Please do not include personal data of third parties or confidential data of our customers in your report.

Coordinated vulnerability disclosure policy

Scope. This policy covers all products and services of MARSIG mbH, in particular:

  • searecs - electronic record book: the onboard software installed on ships
  • searecsCLOUD: the optional cloud service working together with the onboard software or standalone
  • Service Portal: a web application developed for a customer
  • this website, marsig.com

What you can expect from us.

  • We confirm receipt of your report within 3 working days.
  • We give you an initial assessment within 10 working days and keep you informed about our progress at least every 30 days.
  • We work on a fix and agree with you on the date of publication. Our aim is to publish within 90 days of the report.
  • With your consent, we name you as the finder in the security advisory.
  • We will not take legal action against anyone who reports a vulnerability in good faith and in line with this policy.

What we ask of you.

  • Give us reasonable time to fix the vulnerability before you disclose it publicly.
  • Only test as far as necessary to demonstrate the vulnerability. Do not access, change or delete data that is not yours, and stop as soon as you reach such data.
  • Do not test on ships or systems in operation without the owner's permission, and do not disrupt our services (no denial-of-service attacks).
  • Do not use social engineering, phishing or physical attacks against MARSIG staff, customers or premises.

We do not offer a bug bounty.

If we find a vulnerability in a third-party or open-source component used in our products, we report it to the maintainer of that component.

Support period

The support period of our products, including its end date, is stated in the product documentation. During the support period we handle vulnerabilities and provide security updates free of charge.

Security advisories

Fixed vulnerabilities are published here as security advisories.

No security advisories have been published yet.