VELUX Coordinated Vulnerability Disclosure Policy
At VELUX, we take the security of our users, products and services seriously. We are committed to ensuring a high level of cybersecurity and resilience throughout the lifecycle of our products with digital elements and related services. Despite our best efforts, vulnerabilities may still occur. Reporting such vulnerabilities helps us improve the security and reliability of our offerings, and we are dedicated to addressing potential security vulnerabilities.
This Coordinated Vulnerability Disclosure (CVD) Policy defines the process for reporting vulnerabilities to VELUX A/S and describes how we handle such reports.
This policy applies to any potential vulnerability affecting the cybersecurity of VELUX products or services, and we appreciate you reading this policy before submitting a report.
We value and recognize the effort that security researchers put into helping us identify and address potential vulnerabilities, however we do not offer any rewards for vulnerability reports and disclosures.
Who is the manufacturer?
How to report a vulnerability
If you believe you have identified a potential security flaw in any of our products, please write an e-mail to our products security team at psirt@hynquorvexum.live to submit your report as all vulnerability reports must be submitted through this official channel.
It will be picked up by the Single Point of Contact (SPOC) for vulnerability reporting and coordination.
It helps us greatly if you include as much information as possible.
Mandatory information:
- Affected asset (e.g. product name, model, software version, web/IP address, etc.) where you have observed the vulnerability
- Title or identifier of vulnerability
- Detailed description of the vulnerability (provide a summary, including supporting files and possible mitigations or recommendations)
- Impact assessment (how could the vulnerability be abused/exploited by an attacker, and what would be the consequence?)
- Step-by-step to reproduce.
- Reporter name
- Report E-mail
Optional but recommended information:
- Weakness (e.g. CWE) (optional)
- Severity (e.g. CVSS v3.0 rating) (optional)
Providing complete and accurate information will help us process your report more efficiently.
"VELUX A/S processes your data in line with our Privacy Policy.
What happens next?
Acknowledgement: We will respond to your report within 5 business days.
Initial assessment: Perform triage of your report within 10 business days.
Ongoing communication: During this time, we will aim to keep you reasonably informed of progress.
Remediation: Address validated vulnerabilities based on risk (impact, severity, exploitability). This process may take some time. You are most welcome to contact us if you would like an update on the status, but we recommend allowing at least 14 days between each enquiry, to allow our teams to focus on the triage and remediation. We aim to remediate vulnerabilities within a reasonable timeframe, depending on complexity and risk.
Notification: Once the vulnerability you have reported is remediated, we will notify you and potentially ask you to verify that the remediation addresses the vulnerability sufficiently.
Disclosure coordination: We welcome a coordinated public disclosure where appropriate. Our CVD policy includes that guidance for affected users should take place as appropriate. While we welcome requests for disclosure of your report, we urge that any public release happens in coordination with us and only where we deem it necessary and appropriate. Where relevant, after resolving the reported vulnerability, a Security Advisory will be published here.
Regulatory reporting: We will fulfil applicable obligations under the respective regulations.
General guidance
We ask you to conduct your report with responsibility and in good faith, and refrain from:
- Violate any applicable laws or regulations
- Access, modify, or delete data beyond what is strictly necessary
- Access personal or sensitive data unnecessarily
- Modifying data in our systems or services in any way
- Use destructive or high-intensity scanning techniques
- Perform denial-of-service (DoS/DDoS) testing
- Disrupt our systems or services
- Attempt social engineering, phishing, or physical attacks
- Disclose vulnerabilities to third parties without coordination with VELUX A/S
VELUX A/S reserves the right to take legal action in case of non-compliance with this policy. On the other hand, VELUX A/S will not initiate legal action against researchers acting in good faith and in accordance with this policy.