LiSEC takes the security of its products seriously. The LiSEC Product Security Incident Response Team (PSIRT) is your single point of contact for security vulnerabilities in LiSEC products. If you believe you have found one, we want to hear from you. This policy explains how to report it and what you can expect from us.

Scope

This policy covers LiSEC’s own products with digital elements – the software, firmware, and connected functions and cloud-based services of LiSEC machines and applications, together with the security updates we provide for them. Vulnerabilities in third-party products, or in LiSEC’s general corporate IT and websites, are not in scope.

How to report a vulnerability

Send your report to the LiSEC PSIRT at psirt@lisec.com.

Please tell us:

• the affected product, type / article number and software or firmware version;
• the configuration and operating environment in which it occurs;
• a detailed description of the vulnerability and its impact;
• the steps to reproduce it, and any proof-of-concept; and
• if available, your name, organization, country and email, and whether you wish to be credited.

How we handle your report

• The PSIRT aims to acknowledge your report within 5 working days and, where needed, asks for further information.
• We validate the vulnerability, assess its severity, and develop a suitable remedy; complex cases may take longer.
• LiSEC may provide status updates during the assessment and remediation process where appropriate.
• If we receive no response from you within 60 working days, we may close the case.
• Where appropriate and at LiSEC's discretion, LiSEC may publish an advisory. Any public acknowledgement of a reporter will occur only with the reporter's consent.
• LiSEC treats vulnerability reports confidentially, subject to applicable legal, regulatory and operational requirements.

What we ask of you

• Give us a reasonable time to remedy the issue and coordinate the timing of any public disclosure with us.
• Only test systems that you own or are explicitly authorized to test, and limit your testing to what is necessary to demonstrate the vulnerability.
• Do not access, modify or delete data that is not yours, run denial-of-service tests, or use social-engineering or physical attacks.

Reporting to the authorities

Where required under applicable law, including the Cyber Resilience Act, LiSEC may report actively exploited vulnerabilities or significant cybersecurity incidents to competent authorities through the applicable reporting mechanisms.