Vulnerability Reporting and Response Process

Introduction

At Pyronix, we take the security of our products, systems, and services seriously. We welcome and encourage responsible disclosure of any vulnerabilities that may affect the confidentiality, integrity, or availability of our solutions.

This policy outlines how to report vulnerabilities and what you can expect from us in return.

Reporting a Vulnerability

If you believe you have identified a security vulnerability, please report it to us as soon as possible by filling in the form at the bottom of this page.

To help us investigate efficiently, please include:

A clear description of the vulnerability.
The affected product(s), firmware version(s), or service(s).
Steps to reproduce the issue.
Any supporting material (e.g. screenshots, logs, proof-of-concept code).

Secure Communication

For vulnerability reports containing sensitive information, please use our designated PGP encryption mechanism to securely submit details and supporting evidence.

Our PGP public key is available to [download here].

Instructions for using our PGP key to encrypt and submit vulnerability reports are [available here].

If you are unable to use PGP encryption or require an alternative secure communication method, please contact us at report@pyronix.com

Scope

This policy applies to security vulnerabilities affecting:

Pyronix hardware products.
Firmware and embedded software.
Mobile applications and web applications developed or operated by Pyronix.

Cloud services and supporting infrastructure operated by Pyronix.
Third-party components incorporated into Pyronix products where vulnerabilities may impact the security of Pyronix products or services*.

If you are unsure whether an issue falls within the scope of this policy, we encourage you to report it. We will assess the submission and determine the appropriate course of action.

*We will take reasonable action to resolve issues with third-party components. However, as these components are outside of our direct control, we cannot guarantee that the issue can be rectified or resolved by Pyronix.

Our Commitment

When you report a vulnerability in accordance with this policy, we will:

Acknowledge receipt of your report within 2 working days of confirming the reported vulnerability.
Provide updates on our progress where appropriate.
Validate and remediate identified vulnerabilities in accordance with applicable regulatory requirements and recognised industry best practice.
Coordinate disclosure of vulnerabilities with the reporter and other affected parties, where appropriate, to allow reasonable time for remediation before vulnerability details are made public.
Where appropriate, request or assign a Common Vulnerabilities and Exposures (CVE) identifier for confirmed vulnerabilities.
Notify you when the vulnerability has been resolved and, where appropriate, publish details of the vulnerability, affected products, and the associated remediation on our Security Advisory webpage.
We will work with you to coordinate the disclosure of the vulnerability and its remediation, taking into account the vulnerability's severity and potential impact, applicable regulatory requirements, and the availability of corrective or mitigating measures.

Responsible Disclosure

We ask that you:

Avoid exploiting the vulnerability beyond what is necessary to demonstrate it.
Do not access, modify, or delete data that does not belong to you.
Do not disrupt services or systems.
Keep details of the vulnerability confidential until we have had a reasonable opportunity to investigate and resolve it.

Safe Harbour

We support good-faith security research and will not pursue legal action against individuals who:

Act in good faith and in accordance with this policy.
Avoid accessing, modifying, or deleting data that does not belong to them.
Do not intentionally disrupt our products, services, or systems.
Do not use or disclose vulnerabilities for financial gain or malicious purposes
Report vulnerabilities to us promptly and allow us a reasonable opportunity to investigate and remediate them before public disclosure.

This safe harbour applies only to activities conducted within the scope of this policy and does not apply to conduct that violates applicable law or regulation.**

**Pyronix reserves the right of final interpretation of this statement.

Exclusions

The following are generally considered out of scope:

Issues that require physical access to a device, unless they demonstrate a bypass of intended security controls.
Denial-of-service (DoS) attacks, including attempts to disrupt the availability of products, services, or systems.
Brute-force attacks in the attempt to gain unauthorised access via trial-and-error methods.
Social engineering, phishing, or other attacks targeting employees, customers, or third parties.
Vulnerabilities in third-party systems or services that are not controlled by Pyronix.

Recognition

We appreciate the efforts of security researchers who help us improve the security of our products and services. At our discretion, we may:

Acknowledge your contribution on our Security Advisory webpage or other appropriate channels

Questions

If you have any questions about this policy or the vulnerability reporting process, please contact us at report@pyronix.com