Security Disclosure Policy
USTP – University of Applied Sciences St. Pölten attaches great importance to the security of its IT systems, web applications and digital services. Despite appropriate technical and organisational measures, security vulnerabilities may occur.
This policy describes how such vulnerabilities can be reported responsibly.
This policy applies to all IT systems, web applications and online services operated or administered by USTP under its domains.
Reporting Security Vulnerabilities
If you discover a potential security vulnerability, we kindly request responsible disclosure.
Please report vulnerabilities exclusively via:
Email: security+disclosure@ustp.at
Where possible, please include:
- a description of the vulnerability,
- affected systems or URLs,
- reproducible steps,
- relevant screenshots or logs (where legally permissible),
- a contact email address.
Expected Conduct
We ask reporters to:
- refrain from accessing, modifying, deleting or exfiltrating data,
- avoid disruption of services or operations,
- refrain from social engineering or phishing activities,
- not disclose information about the vulnerability publicly before resolution,
- limit testing strictly to what is necessary to identify the issue.
Handling of Reports
The university will:
- acknowledge receipt of the report,
- assess and validate the reported issue immediately,
- treat submitted information confidentially,
- process personal data in accordance with the GDPR,
- not disclose personal data unless legally required.
The USTP does not operate a bug bounty programme and cannot offer financial rewards.
Legal Notice
This policy does not constitute a legally binding assurance or a waiver of liability for unlawful actions.
General legal Entity & Contact
USTP – University of Applied Sciences St. Pölten
Campus‑Platz 1, 3100 St. Pölten, Austria
Email: csc@ustp.at
