Coordinated Vulnerability Disclosure (CVD) Policy

1. Introduction

At Delmic, we consider the security of our products, systems, and user data to be our highest priority. Despite our rigorous development and testing processes, we recognize that vulnerabilities may still exist.

This Coordinated Vulnerability Disclosure (CVD) policy outlines our approach to receiving, investigating, and resolving security vulnerabilities reported by independent security researchers, users, and the broader security community. We encourage you to report any potential vulnerabilities you discover so we can address them promptly.

 

2. Safe Harbor (Legal Authorization)

We consider security research and vulnerability disclosure activities conducted in accordance with this policy to be “authorized” conduct.

If you make a good faith effort to comply with this policy during your security research, Delmic will not initiate or recommend any legal action against you, nor will we ask law enforcement to investigate you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will make it known that your actions were conducted in compliance with this policy.

 

3. Scope

In Scope: This policy applies to all products with digital elements manufactured by Delmic, including:

• METEOR, MIMAS, SPARC, SECOM, FAST-EM, JOLT and CERES CS
• Odemis

Out of Scope: To ensure the safety of our systems and users, the following test methods and vulnerability types are strictly prohibited and out of scope:

• Attacks on physical security (e.g., office access, hardware theft).
• Social engineering (e.g., phishing, vishing) of our employees, contractors, or customers.
• Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks.
• Spam or volumetric email testing.
• Vulnerabilities in third-party services not managed by Delmic.

 

4. Reporting a Vulnerability

If you believe you have found a security vulnerability, please report it to us as soon as possible. The single point of contact for all vulnerability reports is:

Email: security@delmic.com

What to include in your report: To help us resolve the issue as quickly as possible, please provide:

• A description of the vulnerability and its potential impact.
• The specific product, version, or URL affected.
• Detailed steps to reproduce the issue.
• Proof-of-concept (PoC) code, screenshots, or logs (do not share sensitive user data).

 

5. Rules of Engagement (What we expect from you)

When investigating a potential vulnerability, you must:

• Promptly report the vulnerability to us.
• Make every effort to avoid privacy violations, degradation of user experience, or disruption to production systems.
• Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not compromise or exfiltrate data, establish persistent access, or pivot to other systems.
• If you encounter sensitive data (including Personally Identifiable Information, financial data, or proprietary trade secrets), you must stop your test immediately, notify us, and securely delete the data.
• Keep information about the vulnerability confidential until we have resolved the issue and agreed on a coordinated disclosure timeline.

 

6. Our Commitments (What you can expect from us)

When you submit a vulnerability report in good faith, Delmic commits to the following:

• Acknowledgment: We will acknowledge receipt of your report within 5 business days.
• Triage and Assessment: We will confirm the existence of the vulnerability and provide you with an initial assessment within 15 business days.
• Updates: We will keep you informed of our progress throughout the remediation process.
• Remediation: We will resolve the vulnerability as quickly as possible. The timeline will depend on the severity and complexity of the issue.
• Recognition: If your report leads to a vulnerability fix, we will publicly recognize your contribution (if you wish to be credited) in our security advisories.

 

7. Coordinated Disclosure and Publication

We strive to resolve all vulnerabilities promptly. Under the EU Cyber Resilience Act, Delmic is required to publish security advisories for fixed vulnerabilities.

We ask that you do not publicly disclose the vulnerability details until a patch has been made available to our users and we have mutually agreed on a disclosure timeline.