Product Security
Reporting a Vulnerability or Security Incident
SIKORA takes the security of its products seriously. If you have identified a potential vulnerability, or if you believe one of our products has been affected by a security incident, please contact our Product Security Incident Response Team (PSIRT)
This is a dedicated, function-based mailbox monitored by our Product Security team. Please do not use general contact channels for security reports, as this may delay handling.
What to include in your report
To help us assess your report quickly, please provide as much of the following as possible:
- Affected product, model, and firmware/software version
- A description of the vulnerability or incident
- Steps to reproduce, if applicable
- Any evidence of active exploitation
- Your contact details for follow-up questions
Our process
We acknowledge receipt of every report within 7 calendar days. Reports are evaluated for applicability, criticality, and whether active exploitation or a serious security incident is involved.
Where required, we report to the relevant national and EU authorities via the ENISA Single Reporting Platform within the deadlines set out in Article 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847): an early warning within 24 hours, a detailed report within 72 hours, and a final report once corrective action is available. Affected customers are informed as soon as the facts of a case are confirmed.
Confidentiality
We ask finders to report vulnerabilities to us confidentially and to allow us reasonable time to develop and provide a remedy before any public disclosure. We classify the sensitivity of reported information using the Traffic Light Protocol (TLP) to ensure it is shared only with those who need it, at the right time.
We appreciate the work of security researchers and thank you for helping us keep our products secure.
