FIBRAIN PRODUCT SECURITY
🤝 Coordinated Vulnerability Disclosure Policy
FIBRAIN supports the responsible identification, reporting and coordinated disclosure of cybersecurity vulnerabilities affecting products manufactured, imported or distributed by FIBRAIN.
This policy describes how potential vulnerabilities should be reported and how FIBRAIN coordinates their assessment, remediation and disclosure depending on FIBRAIN’s role in relation to the affected product.
🎯
Scope
This policy applies to potential cybersecurity vulnerabilities affecting FIBRAIN/HALNy products and products from other manufacturers imported or distributed by FIBRAIN. It also covers third-party software and components incorporated into FIBRAIN/HALNy products where a vulnerability may affect product security.
The actions taken after a report is received depend on FIBRAIN’s role in relation to the affected product. For FIBRAIN/HALNy products, FIBRAIN coordinates the vulnerability handling process as the manufacturer. For products manufactured by other vendors, including products distributed or imported by FIBRAIN, FIBRAIN may coordinate the report with the relevant manufacturer or supplier.
📨 Reporting a Potential Vulnerability
The FIBRAIN Security Portal is the single point of contact for reporting and receiving information concerning potential cybersecurity vulnerabilities covered by this policy.
Potential cybersecurity vulnerabilities affecting products covered by this policy should be reported through the portal. When submitting a report, select the appropriate device brand and provide as much relevant technical information as reasonably possible.
Where possible, include:
- affected product, model and brand,
- firmware or software version,
- description of the suspected vulnerability,
- steps required to reproduce the issue,
- potential security impact or attack scenario,
- proof-of-concept, logs, screenshots or other supporting information, where available,
- information indicating whether the issue is already public or may be actively exploited, if known.
🔬
Responsible Security Research
Security testing should only be performed on devices, systems and networks that you own or are explicitly authorised to test. Research should be conducted responsibly and in accordance with applicable law.
- avoid disrupting networks, services or deployed products,
- avoid accessing, modifying or deleting data belonging to other users,
- minimise the collection of data to what is necessary to demonstrate the vulnerability,
- avoid actions that could negatively affect customers, operators or end users,
- do not use a vulnerability beyond what is reasonably necessary to demonstrate and investigate its security impact,
- protect non-public vulnerability information while coordinated disclosure is in progress.
Important: This policy does not grant permission to access or test systems, devices, networks or data that you do not own or are not otherwise authorised to access.
VULNERABILITY HANDLING
What Happens After a Report?
01 — RECEIVE
Report Reception
FIBRAIN registers and reviews the report. We may request additional information needed to understand, reproduce or appropriately route the reported issue.
02 — ASSESS
Assessment
We identify the affected product and FIBRAIN’s role in relation to it, assess the reported behaviour and, where applicable, determine affected products, firmware versions, components and potential security impact.
03 — REMEDIATE
Remediation & Coordination
For products manufactured by FIBRAIN, appropriate corrective or mitigating measures are evaluated. Where another manufacturer, software maintainer, chipset supplier or component vendor is involved, FIBRAIN may coordinate the investigation and remediation with that party.
04 — DISCLOSE
Coordinated Disclosure
Where appropriate, disclosure is coordinated so that affected customers and operators can receive relevant remediation or mitigation information without creating unnecessary additional security risk.
⏱️ Coordinated Disclosure
We ask reporters to allow the party responsible for the affected product a reasonable opportunity to investigate and address a reported vulnerability before detailed technical information is disclosed to third parties or made public.
The appropriate disclosure timeline depends on the circumstances of each case, including severity and potential impact, complexity of remediation, affected products and firmware versions, third-party dependencies, availability of mitigations or security updates, and time reasonably required for affected customers or telecommunications operators to deploy corrective measures.
For products manufactured by FIBRAIN, we aim to coordinate the timing and content of public disclosure with the reporter where reasonably possible. For products manufactured by other vendors, disclosure may also require coordination with the relevant manufacturer and may be subject to that manufacturer’s vulnerability disclosure process.
🔗
Third-Party and Multi-Vendor Vulnerabilities
Products may contain software, libraries, chipsets, SDKs, firmware and other components supplied by third parties. A vulnerability may therefore affect more than one product, manufacturer or supplier.
Where appropriate, FIBRAIN may coordinate relevant vulnerability information with product manufacturers, component suppliers, software maintainers, vulnerability coordinators, CERTs or CSIRTs, and other parties involved in investigation, remediation or coordinated disclosure.
📢
Security Advisories
For vulnerabilities affecting products manufactured by FIBRAIN, information about confirmed and remediated vulnerabilities may be published through HALNy Security Advisories or other appropriate FIBRAIN security communications.
An advisory may identify affected products and firmware, describe the vulnerability and impact, provide severity and CVE information where applicable, and identify a fixed version, mitigation or recommended corrective action.
View Security Advisories →💬
Communication With the Reporter
Communication concerning a vulnerability submitted through the FIBRAIN Security Portal should normally continue through the portal so that information remains associated with the relevant security case.
Reporters may receive updates regarding the handling of their report through the FIBRAIN Security Portal. Ticket statuses indicate the current stage of handling, including initial investigation, technical investigation, requests for additional information, coordination with third parties, remediation and closure.
FIBRAIN may request additional information, provide appropriate status information, coordinate with another manufacturer or supplier and discuss disclosure arrangements. Where appropriate and with the reporter’s consent, FIBRAIN may acknowledge the individual or organisation that responsibly reported a confirmed vulnerability.
🛠️ General Technical Support
The FIBRAIN Security Portal is intended for cybersecurity vulnerabilities and product security issues. Connectivity problems, configuration assistance, hardware failures, RMA requests and other non-security support matters should be submitted through the appropriate technical support channel.
For HALNy products: HALNy Helpdesk →
⚖️ Legal Considerations
This policy does not grant permission to access, test or modify systems, networks, devices or data that you do not own or are not authorised to access. Security research and vulnerability testing must be conducted in accordance with applicable law and any applicable contractual or access restrictions.