At VisionSpace, our commitment to security extends beyond our software and systems. We understand the importance of safeguarding the broader space software ecosystem, including third-party code and systems. If our security researchers discover a vulnerability in someone else’s code or systems, we adhere to the following responsible disclosure process:
Verification and Documentation
When we identify a vulnerability in third-party code or systems, our security team verifies the issue to ensure its validity and impact. We provide detailed documentation of the vulnerability and its potential impact throughout the process.
Responsible Disclosure
We prioritize the responsible disclosure of the discovered vulnerability to the affected party or vendor. Our team will make every effort to establish communication with the vendor or relevant stakeholders in a secure and timely manner. The notification includes clear and concise details about the vulnerability’s nature, potential impact, and reproduction steps.
Support and Collaboration
Throughout the remediation process, we offer our assistance and expertise to the affected party. We believe in fostering a collaborative environment to facilitate prompt and effective resolution of vulnerabilities.
Confidentiality and Embargo
We respect the vendor’s request for a limited embargo period to address the vulnerability before public disclosure. Unless the vendor agrees, we refrain from sharing details about the vulnerability with external parties during this period.
Public Disclosure
Once the vendor fixes the vulnerability or mitigation is available, we work with the vendor to determine a timeline for public disclosure. We strive to ensure that the disclosure process aligns with industry best practices and minimizes the risk of malicious exploitation. Not all software is distributed publicly, in some cases no public disclosure can happen, and we acknowledge the potential of limit distribution.
Continuous Engagement
We maintain open communication with the affected party throughout the disclosure process. We encourage regular updates on the progress of remediation efforts and remain available for any additional support required.
Legal and Ethical Considerations
We abide by all legal requirements and ethical principles throughout the disclosure process. We respect the intellectual property rights and privacy considerations of the affected party.
Credit and Recognition
If the affected party consents, we will acknowledge their cooperation and successful remediation efforts when publicly disclosing the vulnerability.
At VisionSpace, we are committed to making the space community more secure for everyone. Our desire to promote a safer online environment and foster collaboration within the cybersecurity community drives the responsible approach to handling third-party code and systems vulnerabilities.
