LAE coordinated vulnerability disclosure policy
LAE Electronic coordinated vulnerability disclosure policy provides a comprehensive overview of the vulnerability disclosure process, including the scope, reporting, analysis, handling, and disclosure of vulnerabilities. To ensure a smooth experience, we highly recommend reading this policy in its entirety before reporting any vulnerabilities.
Scope:
This vulnerability disclosure policy applies to any potential vulnerability from any LAE Electronic product and service regardless of its lifecycle status.
Out of scope
We do not accept the reporting of the following vulnerabilities:
- Vulnerabilities on products or services that have been licensed or transferred to a third-party by LAE Electronic
- Security incidents or attacks
- Technical support requests
Process
In LAE Electronic, we follow a four-step process for handling and disclosing vulnerabilities.
The steps include: 1) Reporting, 2) Analysis, 3) Handling, and 4) Disclosure.
1. Reporting
We encourage you to report any potential vulnerabilities in LAE Electronic products and services within the defined scope. Please submit your report via the Report a vulnerability form.
While LAE Electronic accepts anonymous reports, please note that if you choose to remain anonymous, we will be unable to communicate with you during the vulnerability disclosure process.
2. Analysis
LAE Electronic will thoroughly investigate and attempt to reproduce the reported vulnerability, following our internal procedures. We will keep you informed of our progress and may request additional information during this process.
Once the vulnerability is confirmed, we will conduct a risk assessment to determine its severity level and evaluate potential impacts and consequences.
3. Handling
In case the vulnerability is confirmed, LAE Electronic will proceed to define a remediation plan. The implementation of this plan will be prioritized based on the severity level and the evaluated impacts and consequences from the previous analysis.
Please note that for end-of-life products and services that are no longer supported, LAE Electronic may only provide recommendations as we cannot offer remediations.
3. Handling
In case the vulnerability is confirmed, LAE Electronic will proceed to define a remediation plan. The implementation of this plan will be prioritized based on the severity level and the evaluated impacts and consequences from the previous analysis.
Please note that for end-of-life products and services that are no longer supported, LAE Electronic may only provide recommendations as we cannot offer remediations.
4. Disclosure
After resolving the reported vulnerability, LAE Electronic will publish a Security Advisory.
4.1 LAE Electronic product vulnerability disclosure case
LAE Electronic follows a careful process when addressing vulnerabilities in our products and services. We strive to maintain a balance between transparency and allowing customers sufficient time to apply necessary fixes. As a result, the publication of advisories may be delayed to minimize potential customer impacts.
4.2 Acknowledgement
LAE Electronic acknowledges all individuals, organizations or companies who on own initiative have reported and helped us in mitigating one or multiple vulnerabilities associated with our products and services.
If you have opted-in and provided explicit consent, we will acknowledge your contributions by publishing your name in the LAE Electronic Hall of Thanks.
Please note that vulnerabilities previously published or those classified as “informational” will not be eligible for inclusion on our acknowledgment page.
Legal notice:
During the process, you are expected to comply with the following requirements:
- Comply with the relevant laws and regulations.
- Do not exploit or take advantage of the vulnerability more than strictly necessary.
- Conduct product testing without any adverse impact on customers and individuals, or obtain before an explicit consent from them.
- Do not disrupt any LAE Electronic’ service.
- Do not use high-intensity methods and invasive scanning tools.
- Take measures to prevent any negative impact on the safety or privacy of individuals.
- Do not access unnecessary, excessive, or significant amounts of data.
- Do not modify data in LAE Electronic’ systems or services.
- Do securely delete all data retrieved as part of your vulnerability report as soon as it is no longer required.
- Perform coordinated disclosure by not publicly disclosing the vulnerability before the expiration of a mutually agreed timeline.
LAE Electronic reserves the right to take legal action in case of non-compliance.
History
Ver.1 (25-06-2024): Publication
