Disclosure Policy

Framework for Coordinated Disclosure

Guidelines for the Coordinated Disclosure of Vulnerabilities

This policy outlines the framework for the responsible reporting and coordinated disclosure of vulnerabilities in our products and solutions.

Our Expectations

We welcome reports from security researchers, customers, partners, and other third parties. Please note:

Please report any potential vulnerabilities confidentially to our PSIRT
Please give us enough time to analyze and process the information.
Please coordinate any planned announcements with us and do not disclose any technical details prior to the coordinated disclosure.
Do not exploit vulnerabilities beyond what is necessary to demonstrate their existence

Responsible Security Research

Tests should be conducted exclusively on your own devices, in your own test environments, or with the appropriate authorization. Third parties must not be affected in the process.

In particular, the following are not permitted:

Attacks on production systems belonging to customers or third parties
unauthorized access to data, systems, or networks
Reading, Modifying, or Deleting Third-Party Data
Social Engineering or Phishing
physical attacks
Tests that affect system availability

What You Can Expect From Us

We process incoming vulnerability reports according to a structured process and, provided you share your contact information with us, will keep you informed of the results of our assessment.

For more information, visit Processing Procedure.

No bug bounty program

We do not operate a bug bounty program. Therefore, reporting a vulnerability does not entitle the reporter to any financial or other material compensation. With the reporter’s consent, we may acknowledge the reporter by name for a valid vulnerability that was reported in a coordinated manner.