Security Vulnerability Disclosure Policy

LAGENIO is committed to maintaining the security of its connected products and associated software. We encourage customers, security researchers, and other interested parties to report potential security vulnerabilities to help us identify, assess, and address security risks.

LAGENIO will follow industry standards, including ISO/IEC 30111 and ISO/IEC 29147, when handling reported security vulnerabilities. Our vulnerability response process includes verification, risk assessment, remediation, and coordinated disclosure.

1. Reporting a Security Vulnerability

If you discover a potential security vulnerability affecting a LAGENIO product or its associated software, please report it using the following contact information:

Email: support@lagenio.com

Suggested Email Subject: Security Vulnerability Report

To help us investigate the issue, please provide the following information where possible:

  • The affected product name, model, and software or firmware version.
  • A description of the vulnerability and its potential security impact.
  • Steps to reproduce the issue and any relevant supporting information.

You may still submit a report if some information is unavailable. Please avoid including unnecessary personal or sensitive information.

2. Acknowledgement and Status Updates

LAGENIO will respond to reported security vulnerabilities according to the following timeframes:

  • Initial Acknowledgement: We will acknowledge receipt of your security vulnerability report within 7 working days of receiving it.
  • Status Updates: We will provide the person who reported the issue with a status update at least once every 30 calendar days until the reported security issue is resolved.

Investigation and resolution times may vary depending on the nature, severity, and complexity of the reported issue.

3. Vulnerability Response Process

LAGENIO follows a structured process for handling reported security vulnerabilities:

  1. Receive: Receive and acknowledge security vulnerability reports submitted through the published reporting channel.
  2. Verify: Investigate reported vulnerabilities, verify their validity where possible, and assess their potential impact and severity. Additional information may be requested from the reporter when necessary.
  3. Resolve: Determine and implement appropriate corrective actions for confirmed vulnerabilities, which may include security patches, firmware or software updates, and mitigation measures.
  4. Disclose: Communicate investigation outcomes, relevant security information, response progress, and available solutions to reporters and affected users, as appropriate.
  5. Review: Review handled vulnerabilities to identify opportunities to improve product security and vulnerability management practices.

4. Responsible Disclosure

We encourage responsible and coordinated disclosure of security vulnerabilities. Reporters are asked to avoid unauthorized access to personal data, disruption of services, or activities that could compromise the security or privacy of others.

Where possible, please allow LAGENIO reasonable time to investigate and take appropriate corrective action before publicly disclosing technical vulnerability details.

We appreciate your cooperation in helping maintain and improve the security of LAGENIO products.