VAHLE policy on the responsible disclosure of vulnerabilities

VAHLE develops and supplies products and solutions that meet the highest standards of quality, reliability, and cybersecurity. The VAHLE Computer Emergency Response Team (CERT) supports this objective by assisting in the identification, assessment, and remediation of security vulnerabilities discovered in VAHLE products and solutions by security researchers, partners, customers, or other external parties.

In the event of potential or confirmed security incidents, the VAHLE CERT coordinates the necessary measures with the relevant development, product, and technical experts. This includes assessing the reported vulnerability, developing an appropriate action plan, and maintaining regular communication with the reporter. VAHLE supports the principle of Coordinated Vulnerability Disclosure and therefore requests that reported vulnerabilities be treated confidentially until an appropriate solution or risk mitigation measure has been provided.

Regardless of service contracts or a product’s lifecycle, all individuals and organizations are invited to report identified security vulnerabilities. We welcome reports from security researchers, CERTs (Computer Emergency Response Teams), industry associations, partners, customers, and all other responsible sources.

In doing so, VAHLE respects the interests and wishes of the reporter. Anonymous reports are also accepted.

VAHLE carefully reviews every report and will take appropriate action if the reported vulnerability is demonstrably related to a VAHLE product, VAHLE software, or a VAHLE service.

Premature public disclosure can expose customers and systems to unnecessary risks. Therefore, we strongly recommend a coordinated approach to disclosure.

We ask reporters not to disclose unresolved security vulnerabilities to third parties or make them public until a coordinated disclosure has taken place.

If this policy is followed, VAHLE CERT, in collaboration with the relevant departments, will make reasonable efforts to:

• promptly acknowledge receipt of a vulnerability report,
• evaluate the report and initiate its resolution,
• keep the reporter informed of significant progress,
• provide an estimated timeframe for the assessment and remediation, to the extent possible,
• notify the reporter as soon as a solution, fix, or other appropriate measure is available.

Status updates will be provided as soon as relevant information becomes available.

VAHLE will not take legal action against individuals or organizations that act in good faith and responsibly report security vulnerabilities, provided the following conditions are met:

• No actions are taken that cause harm to VAHLE, its customers, or third parties.
• The privacy, confidentiality, and security of customer, company, or personal data are respected at all times.
• The availability, integrity, or security of systems and services is not compromised.
• No applicable laws or regulations are violated.
• Information regarding the security vulnerability is not disclosed before a coordinated disclosure with VAHLE has taken place or VAHLE has confirmed that the vulnerability has been resolved.

VAHLE values the work and dedication of security researchers, customers, partners, and all other stakeholders who help identify vulnerabilities and report them responsibly. Through this collaboration, we are making an important joint contribution to the security of our products, our customers, and the entire connected industry.

We thank you for your support in continuously improving cybersecurity at VAHLE.