ECS Product Security – Reporting a Vulnerability
ECS S.r.l. Unipersonale (hereinafter ECS) considers the security of its products a priority and welcomes vulnerability reports from security researchers, customers, and users. This page describes how to report a vulnerability and how we manage it, following a Coordinated Vulnerability Disclosure model.
Scope. This policy covers all electronic boards developed by ECS and their relative firmware, as well as the services and cloud platform interfaces associated with our products. Third-party products not supplied by ECS and activities that violate the law or third-party privacy are excluded.
How to Report a Vulnerability
Send your report to: product-security@ecsproject.com
To help us quickly evaluate the report, please include where possible:
- description of the vulnerability and its potential impact;
- affected product, model, and firmware version;
- steps to reproduce the issue (proof of concept, if available);
- configuration and conditions under which it manifests;
- contact information for coordination
Our Commitments and Timelines
| Phase | Target Timeline |
|---|---|
| Acknowledgement of receipt | Within 3 business days |
| Initial evaluation and triage | Within 10 business days |
| Periodic updates to the reporter | At least every 30 days until resolution |
| Development and release of the fix | According to the severity of the vulnerability |
| Coordinated disclosure | Agreed upon with the reporter, usually after the release of the fix |
Coordinated Disclosure Principles
ECS and the reporter mutually agree on the timing and content of any public disclosure. Disclosure typically occurs after a fix or mitigation is available, so as not to expose users in the meantime. If a vulnerability is found to be actively exploited, notification obligations to the competent authorities (ENISA/CSIRT Italia) also apply.
Commitment Not to Take Legal Action
Following a vulnerability report, ECS will not pursue legal action against anyone who reports in good faith and in compliance with this policy, provided that the reporter:
- acts without malicious intent;
- does not compromise the confidentiality, integrity, or availability of third-party data beyond the minimum necessary to demonstrate the issue;
- does not perform denial-of-service attacks;
- does not publicly disclose the vulnerability before coordination has been agreed upon with ECS;
- complies with applicable laws.
Acknowledgments
With the reporter’s consent, ECS may publicly acknowledge their contribution. At this time, the program does not offer monetary rewards, unless otherwise indicated in the future.
