Vulnerability disclosure policy
Last updated: November 2026
This policy tells you how to report a vulnerability in a ConnectMyAssets product, what we do with your report and what you can expect from us. It is the policy referenced by our security.txt.
1. Our commitment
ConnectMyAssets takes the security of its products seriously. We welcome vulnerability reports from security researchers, customers and partners, and we treat every report as a priority.
Reporting a vulnerability to us is not a hostile act: it is the fastest way to protect the networks our customers run.
2. How to report
Send your report to security@connectmyassets.com. If your report needs to be encrypted, tell us in a first message and we will agree on a channel with you.
What to include
- –The product and the version affected
- –A description of the vulnerability
- –The steps to reproduce it
- –The impact you believe it has
- –How we can reach you
3. Scope
In scope
- –The ConnectMyAssets appliance, operating system and application
- –ConnectMyAssets Central
- –This website, connectmyassets.com
Out of scope
- –Volumetric denial of service
- –Social engineering of our staff or our customers
- –Physical attacks against our premises or our customers’ premises
- –Vulnerabilities in our customers’ network devices, which belong to their vendors
- –Flaws in third-party software that are already public, unless the way we integrate them makes them worse
4. What we commit to
Once your report reaches us
- –We acknowledge receipt within 3 business days
- –We send you a first assessment within 10 business days
- –We keep you posted while we work on it
- –We fix the issue in a timeframe that depends on its severity
- –We tell you before we publish anything about it
5. Coordinated disclosure
We ask you to wait 90 days before making your findings public, so that our customers can deploy the fix. That delay is adjustable by mutual agreement: shorter once a fix has shipped, longer for a complex issue or one that involves a third party.
We credit the finder in the advisory, under the name they choose. Anyone who prefers to stay anonymous will not be named.
6. Safe harbour
We will not take legal action over good-faith research that follows this policy. Following this policy means: not accessing anyone else’s data beyond what is strictly needed to demonstrate the issue, not disrupting the service, reporting promptly, and not disclosing before the agreed date.
If a report takes you outside that frame, tell us: we would rather discuss it than learn about it later.
7. Security advisories
Every fixed vulnerability that affects a deployed version is covered by a security advisory: what is affected, the severity, the fixed version and any workaround. Advisories go to the customers concerned through their usual support channel.
To be added to that distribution, or to ask for a past advisory, write to security@connectmyassets.com.
8. Regulatory reporting
As the manufacturer of a product with digital elements, we report actively exploited vulnerabilities and severe security incidents to the coordinating CSIRT (ANSSI in France) and to ENISA, within the deadlines set by the Cyber Resilience Act, Regulation (EU) 2024/2847: an early warning within 24 hours, a notification within 72 hours, then a final report.
This reporting is an obligation towards the authorities. It neither replaces nor delays what we owe you: the deadlines of this policy stand.
9. No bug bounty
We do not run a bug bounty programme and we do not pay for reports. What we offer is a serious review, a fix, and credit in the advisory if you want it.
Reports: security@connectmyassets.com