What should the report include?

• the product name and model,
• the software or firmware version, if known,
• a description of the identified vulnerability or security issue,
• steps to reproduce the issue,
• the potential impact of the vulnerability on the security of the product or the user,
• the date on which the issue was identified,
• contact details enabling us to contact the reporter,
• additional materials, such as logs, screenshots or other technical information.

Please do not send passwords, access keys or other authentication credentials.

What happens after a report is submitted?

Each product security report is reviewed by the responsible SANKOM team.

After receiving the report, we may contact the reporter to obtain additional technical information.

Where the vulnerability is confirmed, we take appropriate measures to remediate it or mitigate the risk and, where required, inform users of available corrective measures or security updates.

Reports subject to notification obligations under the Cyber Resilience Act are handled in accordance with the applicable regulatory requirements.