Coordinated Vulnerability Disclosure Policy
IoTReady takes the security of its products and of its customers seriously. We welcome reports from security researchers, customers and anyone else who finds a potential vulnerability, and we commit to handling them promptly, transparently and in good faith. This policy explains how to report a vulnerability, what you can expect from us, and the commitments we ask you to respect.
This policy implements the vulnerability handling requirements of the EU Cyber Resilience Act (Regulation (EU) 2024/2847, Annex I, Part II) and follows ISO/IEC 29147 and ISO/IEC 30111.
Report a vulnerability
Please start the subject line with [SECURITY] so your report is routed directly to our security team. We accept reports in English and Italian.
- Scope
- How to report
- Our commitments
- CRA reporting
- Disclosure
- Rules of engagement
- Safe harbour
- Recognition
- Security advisories
- Privacy
1. Scope
This policy covers products with digital elements and services designed, developed or placed on the market by IoTReady, including:
- IoT devices and embedded firmware
- Cloud platforms, dashboards and back-end services
- Mobile, desktop and web applications
- Public APIs and the websites on
iotready.it
Products developed for customers (OEM and white-label). Where IoTReady develops or manufactures products with digital elements on behalf of a customer, the manufacturer responsible under the Cyber Resilience Act is determined by the legal definitions in the Regulation and by the actual commercial arrangement. Where a customer places the product on the market under its own name or trademark, that customer will generally be the manufacturer and responsible for the related vulnerability handling and reporting obligations. You may still report such vulnerabilities directly to IoTReady: we will cooperate with the customer to investigate, assess and fix them, and coordinate the disclosure where appropriate.
Third-party components. If we find a vulnerability in a third-party or open-source component integrated in our products, we report it to the person or entity maintaining that component, as required by Article 13(6) of the Cyber Resilience Act.
Out of scope:
- Third-party products and open-source components that we do not maintain. Please report these to their maintainers. If one affects our products, tell us too and we will coordinate.
- Technical support requests, account issues and general product questions. Send these to support@iotready.it without the
[SECURITY]tag. - Findings from automated scanners without a demonstrated security impact.
- Missing best-practice settings with no concrete exploitation scenario (e.g. absent security headers, SPF/DMARC configuration, banner disclosure).
2. How to report
Email support@iotready.it with a subject starting with [SECURITY]. To help us act quickly, please include as much of the following as you can:
- Affected product, model, and firmware or software version
- A description of the vulnerability and its potential impact
- Step-by-step instructions to reproduce it, with proof-of-concept code, screenshots or logs where useful
- Your severity estimate (CVSS v4.0 or v3.1 vector) and CWE, if known
- Whether the issue is known to be actively exploited, or has been shared with anyone else
- How you would like to be credited, if at all
Please do not send sensitive data (such as real customer data or credentials) by email. Describe what you were able to access instead, and we will agree a secure way to exchange anything further.
Anonymous reports are accepted, but without a way to contact you we cannot ask follow-up questions or keep you updated.
If you prefer not to contact us directly, or if we do not respond, you can report to the Italian national CSIRT, CSIRT Italia, which can coordinate the disclosure.
3. Our commitments
When you report a vulnerability to us in line with this policy, we commit to the following:
| Step | Target |
|---|---|
| Acknowledge your report with a tracking reference | Within 3 business days |
| Initial assessment: validation and severity rating | Within 10 business days |
| Progress updates to you | At least every 30 days, and at every major milestone |
| Fix or mitigation available | Based on severity, see table below |
| Public security advisory | Once a fix or mitigation is available, coordinated with you |
We rate severity using CVSS (v4.0, or v3.1 where appropriate), taking into account the real-world context of the affected product. Remediation targets are counted from validation of the report:
| Severity | CVSS score | Remediation target |
|---|---|---|
| Critical | 9.0 – 10.0 | As fast as possible, within 30 days |
| High | 7.0 – 8.9 | Within 60 days |
| Medium | 4.0 – 6.9 | Within 90 days |
| Low | 0.1 – 3.9 | In a scheduled release |
These are internal target timelines, not deadlines set by the Cyber Resilience Act. We prioritise remediation based on the assessed risk and fix vulnerabilities without undue delay. Hardware and firmware fixes may need longer because of testing, certification or field deployment. If so, we will tell you why, agree a revised timeline with you, and provide interim mitigations wherever possible. Security updates are provided free of charge for the support period of the affected product.
4. Regulatory reporting (CRA Article 14)
Where IoTReady is the manufacturer of the affected product, and becomes aware of an actively exploited vulnerability in it or of a severe incident having an impact on its security, we notify it through the ENISA Single Reporting Platform to the CSIRT designated as coordinator, and simultaneously to ENISA, within the following deadlines:
| Notification | Actively exploited vulnerability | Severe incident |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Within 24 hours of becoming aware |
| Notification | Within 72 hours of becoming aware | Within 72 hours of becoming aware |
| Final report | Within 14 days after a corrective or mitigating measure is available | Within one month after the 72-hour notification |
We also inform affected users without undue delay and, where needed, tell them what they can do to mitigate the impact. This regulatory reporting is separate from, and runs in parallel with, the coordinated disclosure process described in this policy.
5. Coordinated disclosure
- Our default disclosure deadline is 90 days from the date of your report, or earlier once a fix is available and deployed.
- We will agree the publication date and content with you. If more time is needed (for example for firmware roll-outs or multi-vendor coordination), we will ask for an extension in advance and explain why.
- Where appropriate, we will request a CVE identifier through a CVE Numbering Authority and credit you in the CVE record if you wish.
- You may disclose before the agreed date if we have not acknowledged your report within 14 days, if we state that we will not fix the issue, or if the vulnerability is already being actively exploited. In those cases, please give us a short advance notice so we can protect our users.
The 90-day deadline is IoTReady's own coordinated disclosure practice. It does not replace or extend any statutory reporting or remediation obligation. In line with Annex I, Part II, point (4) of the Cyber Resilience Act, we publish information about fixed vulnerabilities once a security update is available. In duly justified cases, where the security risks of publication outweigh its benefits, we may postpone publication until users have had a reasonable opportunity to apply the update.
6. Rules of engagement
We ask that you:
- Test only against devices, accounts and data that you own or are explicitly authorised to use
- Access, modify or keep data only to the minimum needed to demonstrate the issue, and securely delete it when it is no longer needed
- Avoid degrading or interrupting our services: no denial-of-service, load or high-volume automated testing against production systems
- Do not use social engineering, phishing or physical attacks against our staff, customers or premises
- Do not use a vulnerability beyond what is needed to confirm it, for example to pivot to other systems or install persistent access
- Keep the details confidential until the coordinated disclosure date, except as described in section 5
- Do not demand payment in exchange for the details of a vulnerability
7. Safe harbour
If you act in good faith and follow this policy, IoTReady will consider your research authorised. This authorisation covers only activities carried out in line with the rules of this policy, on systems and products that IoTReady is entitled to authorise testing on. We will not take legal action against you, file a criminal complaint, or report you to law enforcement for that research. If a third party starts legal action against you for activities carried out under this policy, we will make it clear that your research was authorised by us.
This safe harbour cannot override applicable law or bind third parties, such as our customers, whose systems are not covered by this policy. If you are unsure whether an activity is allowed, ask us at support@iotready.it before you go ahead.
8. Recognition
With your consent, we credit researchers who report valid vulnerabilities in the related security advisory and CVE record, and in the acknowledgements below. IoTReady does not currently run a paid bug bounty programme.
Acknowledgements: no entries yet.
9. Security advisories
Security advisories for IoTReady products are published on this page. Each one lists the affected products and versions, the severity, the available fixes or mitigations, and credits.
No security advisories have been published to date.
10. Privacy
Any personal data you share with us (such as your name and email address) is used only to handle your report and to credit you if you wish. It is processed in line with our Privacy Policy. We will not share your identity with third parties, such as an affected customer or a CSIRT, without your consent, unless the law requires us to.
11. Contact
Security reports: support@iotready.it (subject starting with [SECURITY])
Machine-readable contact: /.well-known/security.txt
We review this policy at least once a year and whenever our processes or legal obligations change.