Product security vulnerability disclosure policy

We believe that vulnerability disclosure increases overall safety and security and builds customer trust in our products and services. We welcome disclosures and collaboration with security researchers and reporters. We are committed to addressing reported security vulnerabilities via a coordinated and streamlined approach designed to protect our customers.

Purpose

This policy aims to provide information on how we handle reported security vulnerabilities found on our products and services, including responsibility, communication, report contents, scope, timeline, and security advisory.

Responsible disclosure

We commit to:

Disclose known vulnerabilities and their fixes to our customers in a manner that protects our company and customers. Disclosures made by us will include credit to the person who first identified the vulnerability unless otherwise requested by the one who reported it.
Be open to communicating and working with security researchers or reporters who come to us with a shared interest in improving security and coordinating the distribution of information that includes both the vulnerability and the solution that addresses it.
Publicly acknowledge in a written advisory the work of a security researcher or reporter who brings our company valid information about a vulnerability privately and then works with us to coordinate the public announcement after the availability of a fix.
Allow security researchers or reporters to post our advisory link on their websites as recognition for identifying the vulnerability and working with us to fix it.

Security researchers or reporters shall not:

Exploit a discovered vulnerability other than for testing purposes and should conduct such testing with their account or a test account.
Perform denial of service or social engineering attacks, compromise our system, persistently maintain access to it, install malware or viruses, steal passwords, or use brute force to gain access to our systems.
Share the vulnerability with third parties or distribute it without our expressed consent.
Deliberately attempt to intercept, record, or become aware of communications that are not accessible to the public.
Violate privacy laws or regulations, unauthorized access or destruction of data, and interruption or degradation of our products and services.

Secure communication channel

We request security researchers and reporters to report any potential security vulnerabilities to the Product Security Vulnerability Response Team via the email address aaesproduct.security@assaabloy.com.

We encourage security researchers and reporters to encrypt email communication with (Pretty Good Privacy) PGP encryption software using our public key

Vulnerability report contents

We expect security researchers and reporters to provide the following information (via email) when reporting a potential security vulnerability:

First and Last Name
Company Name (if applicable)
Contact email
Contact phone number
A clear and detailed description of the vulnerability
The action reporters took to discover the vulnerability
Tool used to find the vulnerability
Proof of vulnerability existence (screenshot, link, etc.)
Technical description and steps to reproduce it
Sample code or proof of concept (POC) used to exploit the vulnerability
A description of how the vulnerability impact users
Products with the vulnerability
Other parties and products involved
What was the purpose and scope of research that led to the vulnerability discovery

Product scope

Security researchers or reporters can report a security vulnerability found in any of the following products:

Automatic doors
Commercial and industrial doors
High-speed doors
Digital solutions (Insight, IoT gateway, service tool, and mobile app)
Loading dock equipment
Megadoors

Disclosure timeline

We will respond within 24 hours of receiving a security vulnerability report from security researchers or reporters. We will communicate regularly with security researchers or reporters until the resolution of the security vulnerability.

We expect to remediate a reported and valid vulnerability within 90 days of receiving the report, depending on the complexity, the number of products affected, and the severity.

Advisory publication

We will issue a security advisory on our website once a fix becomes available for the reported vulnerability.