Note on Reporting Product Security Vulnerabilities

Introduction

We are committed to ensuring the security, protection, and reliability of our products, solutions, and services. We welcome reports from customers, security researchers, partners, suppliers, and other external parties who identify potential security vulnerabilities in our products or related services. Responsible reporting helps us investigate, assess, and resolve security issues in a timely manner. This Security Vulnerability Reporting Policy explains how to report a potential security vulnerability, what information a report should include, and how we handle your report.We do not operate a bug bounty program and do not offer financial rewards for reporting security vulnerabilities.

Report an incident related to a security vulnerability

Scope of Application

This policy applies to potential cybersecurity vulnerabilities affecting our products and their associated digital components, including software, firmware, and hardware.This policy does not authorize security testing, penetration testing, scanning, or other activities that could disrupt operations by compromising the confidentiality, integrity, or availability of our products, services, systems, customers, or data.

How can you contact us?

If you believe you have discovered a security vulnerability in one of our products or services, please submit a report using the reporting form available on this page. A member of our Product Security Incident Response Team (PSIRT) may contact you if additional information is needed or to update you on the status of your report.We strive to acknowledge receipt of reports within a reasonable timeframe and, whenever possible, keep the reporter informed throughout the investigation process.

What information should the report include?

Contact information: Your name, email address, phone number (optional), and your organization or company (if applicable).Type of report: Depending on the issue you wish to report, choose between “Security Vulnerability” and “Security Incident.”

Affected product or service: Name of the product or service and, if available, the product number, SKU, or serial number of the machine.

Description: A detailed description of the identified potential security vulnerability. If possible, provide technical details about the issue, the steps required to reproduce the vulnerability, the prerequisites for a potential exploit, and the potential impact of the vulnerability.

Attachments: If possible, please provide supporting information such as screenshots, log files, network traces, proof-of-concept code, or other relevant documentation.

Please do not include any personal data or other sensitive information in this initial report, unless you consider it necessary in the context of explaining the potential security vulnerability in this initial report. If the secure exchange of sensitive files is necessary, the PSIRT team will set up a secure environment for the further exchange of information.

How do we handle your report?

Confirmation of Receipt

Upon submission of a report, you will receive an automated email confirmation acknowledging that the report has been successfully submitted.

Investigation

The reported security vulnerability is being investigated by the relevant teams within our organization. Depending on the nature of the issue, this may involve product security specialists, development teams, product owners, and, if necessary, data protection and data security experts.We will contact the person who reported the issue if additional information is needed to support the investigation.

Communication

The PSIRT team keeps the person who reported the issue informed about the status of the investigation and the actions taken.

Solution

The results of the investigation, as well as any corrective measures, will be communicated to the person who reported the issue and, where applicable, to the relevant authorities, affected users, and other relevant stakeholders.If we become aware of an actively exploited security vulnerability or a serious security incident affecting the security of a product, we will notify the affected users and, where appropriate, all users of the affected product about the vulnerability or incident, as well as any possible measures to mitigate the risk or resolve the issue.

Expectations for Responsible Reporting

We ask those reporting potential security vulnerabilities to act responsibly and in good faith when submitting a report. In particular, we ask that you:

• Avoid actions that could have a negative impact on customers, products, services, or business processes.

• Do not intentionally access, alter, copy, delete, or disclose data that does not belong to you.

• Do not attempt to interfere with the availability of products, systems, or services.

• Cooperate with us during the investigation and resolution process if we have any questions or need additional information.

Coordinated Disclosure

We ask those who report vulnerabilities not to disclose details of a vulnerability publicly before we have completed our internal investigation and implemented the necessary corrective measures, unless a disclosure date has been agreed upon by mutual consent.

When necessary, we publish security advisories, patch notes, or other announcements to inform customers about identified security vulnerabilities and available remediation measures.
Where appropriate, we may publish security recommendations, patch notes, or other communications to inform customers about identified vulnerabilities and available remediation measures.

Safe Harbor

Privacy Policy

We process personal data provided in connection with security vulnerability reports solely for the purpose of receiving, investigating, coordinating, and resolving reported security vulnerabilities, as well as for communicating with the individuals who submitted the reports.

If you have any questions about data protection or would like to learn more about how we process personal data and what data protection rights you have, please read our Privacy Policy.