Security

The security of our products and systems is important to us. If you discover a security vulnerability or any other security-related issue affecting one of our systems, we kindly ask you to let us know.
This policy explains how to report security issues and how we handle incoming reports.

Scope

This policy applies to digital systems, applications and products with digital elements that are developed, manufactured, operated or maintained by us and fall within our responsibility.
Third-party products, systems and devices that are not developed, manufactured, operated or maintained by us are generally outside the scope of this policy. If you discover a security issue affecting such products, please report it directly to the respective manufacturer.
However, vulnerabilities affecting third-party components integrated into our own products may fall within the scope of this policy. Such reports are welcome and will be assessed in accordance with our vulnerability handling processes and applicable regulatory obligations. To identify these 3rd party products where this policy applies, please refer to the SBOM of the related HALaser Systems product.

How to Report a Vulnerability

Please submit your report directly through our contact form
To help us investigate the issue as efficiently as possible, please include the following information in your report:

• The affected product, model and soft- or firmware version
• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Supporting evidence, such as software-generated bug reports, screenshots, videos or a proof of concept
• Whether the vulnerability is already known or is actively being exploited
• Your contact details (optional, but appreciated for any follow-up questions)
• If known, whether the vulnerability affects a third-party component integrated into one of our products, including the component name and version

How We Process Submitted Reports

In the case of critical vulnerabilities or security issues that are actively being exploited, we of course comply with applicable reporting obligations to the relevant authorities. Where applicable, vulnerabilities and security incidents affecting our products with digital elements are also assessed in accordance with the reporting obligations under the EU Cyber Resilience Act (CRA). Actively exploited vulnerabilities and severe incidents affecting the security of our products are reported to the relevant authorities in accordance with the applicable regulatory requirements and deadlines. These regulatory reporting obligations are independent of the communication timelines outlined below and take precedence where statutory deadlines apply.
Where vulnerabilities affect third-party components integrated into our products, we coordinate with the respective component manufacturers or maintainers as necessary to support timely remediation and fulfil our own applicable regulatory obligations.
In general, and as long as not otherwise defined by the EU Cyber Resilience Act, we aim to process vulnerability reports according to the following schedule:

• Within 6 business days: Initial assessment of the reported vulnerability
• Every 12 business days: Status updates on the investigation
• As soon as possible: Provision of a fix or workaround
• After a fix has been released: Publication of a security advisory

Guidelines for Security Researchers

We welcome responsible security testing and appreciate the efforts of security researchers who help us identify and address potential vulnerabilities in our systems. HALaser Systems is committed to review vulnerability reports promptly and addressing identified security issues as quickly as possible. We will not pursue legal action against security researchers who conduct security testing in good faith and in accordance with this policy, subject to applicable law. If you are unsure whether a planned security test falls within the scope of this policy, please contact us before proceeding. When conducting security tests, please observe the following guidelines:

• Please only test systems that are covered by this policy.
• Please avoid disrupting our operations or accessing data belonging to other users.
• Please use only your own test accounts or accounts you are explicitly authorised to use.
• Please limit your access and testing activities to what is strictly necessary to demonstrate the vulnerability.
• If you encounter any confidential or personal data, please stop testing immediately and notify us.
• Please allow us up to 90 days from the date of your report to investigate and address the vulnerability before publicly disclosing any details.
• Please use the contact details provided above for all communication regarding your report.