Security policy for COOK

DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.

This is the coordinated vulnerability disclosure policy required by Regulation (EU) 2024/2847, Annex I, Part II, point (5), with the contact address required by point (6) and Article 13(17).

Reporting a vulnerability

• Email: hello@cookkitchen.fun
• Contact file: [HUMAN: https://your-domain/.well-known/security.txt]
• Please include: the version (2.0.0), steps to reproduce, impact, and whether you have shared the report elsewhere.
• We acknowledge reports within 3 working days and keep you informed of the triage result and the fix timeline.

What to expect

• We investigate every report, rate its severity and work on a fix for confirmed vulnerabilities in the supported versions.
• Security fixes are released as their own update where technically feasible and distributed free of charge (Annex I, Part II, points (2), (7) and (8)).
• Once an update is available we publish an advisory describing the vulnerability, the affected versions, the impact, the severity and the remediation (Annex I, Part II, point (4)). In duly justified cases we may delay publication until users have had the chance to update.
• Vulnerabilities in third-party components are reported to the component's maintainers (Article 13(6)).
• Actively exploited vulnerabilities and severe incidents are notified to the EU single reporting platform within the Article 14 deadlines.

Coordination

• We ask reporters to allow a reasonable period for the fix before public disclosure; we agree a date with you and credit you if you wish.
• Good-faith research within this policy will not be met with legal action by us.

Scope

• In scope: COOK and the remote services it needs to perform its functions.
• Out of scope: third-party platforms and services we do not operate (report those to their owners); social engineering of our staff; denial-of-service testing against our services.

Supported versions

Security updates are provided for the versions within the support period; end of support: [HUMAN: month and year].