WELCOME TO THE MEDIAMARKTSATURN VULNERABILITY DISCLOSURE PROGRAM MediaMarktSaturn Retail Group looks forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe. Please report us, if you find a security bug in the scope of our program in accordance with the rules below. Thank you for helping keep MediaMarktSaturn Retail Group and our users safe!

Vulnerability Disclosure Policy

We appreciate your effort in improving our security but we also do not want our customers to be affected by any of your actions. Therefore, we would be very pleased if you comply with the following rules. For any questions, please don´t hesitate to contact us.

Do’s

• Please provide detailed reports with reproducible steps.

• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

• Please include your IP-Address(es), that you had while testing for the vulnerability, to avoid false alarms when they occur.

Don’ts

• Access or change accounts of other MediaMarkt/Saturn customers.

• Change or create more accounts than necessary for the test.

• Damage or change our systems.

• Compromise the availability of our services (e.g. Denial of Service).

• Run automated scanning.

• Scan the infrastructure of our host-provider “PlusServer GmbH”

• Use any social engineering techniques to access our systems or reach to MediaMarktSaturn employees

• Violate any laws (including at least German and European law and any laws applicable in your country).

• MediaMarktSaturn does not permit reports to be publicly disclosed.

For any questions, please don´t hesitate to contact us.