Vulnerability Disclosure Policy

Reporting Vulnerabilities

Commend International appreciates all efforts of security researchers that support us with detailed information about security vulnerabilities within our products and services. It is essential to us to have sufficient details in the initial report such that we are able to understand the full impact of the reported vulnerability. Our security team is pleased to verify and reproduce the reported vulnerability in a reasonable timeline. Hence, we will respond within 15 days.

Initial report should include:

• Sufficient details of the vulnerability to allow it to be understood and reproduced
• Expected impact of the vulnerability
• Proof of concept code, script, screenshot (if available)
• Any reference or further reading that may be appropriate (if available)
• Recommendation on how the issue could be mitigated or resolved (if available)

Coordinated Disclosure Process

Commend International takes the security of our systems seriously. A coordinated disclosure process is required to protect our customers from any threat actors. A vulnerability report is the starting point. This action creates internally a security issue ticket which will be reviewed by our security team. The initial review results in a first draft impact analysis which concludes in a severity level according to the Common Vulnerability Scoring System (CVSS). Our Security Board members will define the next steps for each reported vulnerability. After that we contact the security researcher again and inform about the remediation plan, possible counter measures or workarounds. Although this may be enough for an easy fix, there are more complex vulnerabilities that require an ongoing discussion for clarification between our security team, the involved developers and the reporting security researcher. We appreciate an open and respectful communication as well as recommendations on how the issue could be mitigated or resolved. Our goal is to prioritize the fix of a critical or high rated vulnerability in a reasonable time by a security patch or if this is not feasible within the next official release. As a final response step the timeline for publishing a Commend Security Advisory (CSA) will be communicated. Hence, we try to fix a reported vulnerability and publish the information within 90 days.