Have you found a vulnerability in a duveka extension for Microsoft Dynamics 365 Business Central? Please report it to us before making it public.
Please put “Security report” in the subject line. Your message then goes straight to the people responsible instead of waiting in the regular queue.
It helps us to know the affected module and its version, how the issue can be reproduced and how you came across it. If you would like to send encrypted, ask for our key at the same address.
We treat reports confidentially and take no legal action against anyone who reports a vulnerability in good faith, as long as they do not alter or extract other people's data or disrupt operations.
Actively exploited vulnerabilities and severe security incidents are additionally reported to the competent authority within the statutory deadlines.
For every duveka extension provided through Microsoft AppSource we deliver security updates for at least five years from the day the respective version is made available. Updates are released for the version of Business Central currently supported by Microsoft and reach you through AppSource.
If we discontinue an extension, we announce it at least twelve months in advance. The promised support period continues regardless.
For every shipped version of a duveka extension we keep a software bill of materials in CycloneDX format. It lists every component with version, supplier and licence. You can request it at support@duveka.de.