What to Include

• Product name or product type
• Product version, build number, model, firmware version, SKU, part number (P/N), or serial number, as applicable
• Platform, environment, or deployment context
• Description of the potential vulnerability
• Steps to reproduce
• Proof of concept or exploit details, if available
• Observed or potential impact
• Screenshots, logs, traces, or other relevant evidence
• CWE ID, CVE ID, CVSS score, or CVSS vector, if known
• Your preferred contact information for follow-up communication

Do not include passwords, access tokens, unnecessary personal data, executable files, or malicious code.

Coordinated Disclosure

EP Cube supports a coordinated disclosure approach. Please do not publicly disclose a vulnerability before remediation and coordinated publication have taken place, unless otherwise agreed in writing.

Disclosure timelines may vary depending on severity and exploitability, product impact and user risk, remediation availability, supply-chain coordination needs, and other case-specific factors.

Anonymous Reporting

Anonymous reports may be accepted. Please note that anonymous reporting may limit our ability to request clarification, provide updates, or coordinate publication.

To Qualify Under This Policy Researchers Should

• Act in good faith and with the goal of improving security.
• Avoid privacy violations, service disruption, and data destruction.
• Refrain from social engineering, phishing, spam, or physical attacks.
• Use only the minimum steps reasonably necessary to demonstrate the issue.
• Promptly report the vulnerability through official channels.
• Avoid public disclosure before remediation and coordinated publication unless otherwise agreed.

Out-of-Scope Conduct

• Accessing, modifying, or deleting data that does not belong to you.
• Intentional service disruption or denial-of-service activity.
• Exploiting vulnerabilities beyond what is reasonably necessary to demonstrate the issue.
• Persistence, lateral movement, or privilege escalation in production systems.
• Physical attacks or hardware tampering unless explicitly authorized in writing.
• Any activity that violates applicable law or regulation.