Vulnerability Disclosure Policy

At Scaderis, the security of our software matters to us and to our customers, who use it in industrial environments. This page explains how to report a security vulnerability to us, what you can expect from us, and how we handle coordinated disclosure.

1. How to report a vulnerability

Send your report to with the subject "Security".

Customers can also open a ticket on the Support Portal (https://support.scaderis-software.com) and mark it as a security report.

If you need to exchange sensitive information in encrypted form, say so in your first message and we will agree on a secure channel with you.

Please include, as far as you can:

• The product name and the version(s) affected
• A description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce it, or a proof of concept
• Any relevant configuration, logs or screenshots (without personal data, see section 5)
• Whether you plan to publish your findings, and when
• How we can contact you, and whether you want to be credited

2. What you can expect from us

Step	Our target
Acknowledgement of your report	within 3 business days (within 1 business day if the report indicates a critical vulnerability or active exploitation)
Initial assessment (confirmed or not, severity)	within 10 business days
Progress updates	at least every 30 days, and at each important step
Fix	as fast as possible; we aim to release a fix within 90 days at most, and much sooner for critical or actively exploited vulnerabilities

These are targets, not guarantees. Complex issues may take longer, and we will tell you why.

When a vulnerability is confirmed, we will:

1. Develop and test a fix
2. Release it as a Security Update, free of charge for all License holders, through our Support Portal, whether or not their support period is current
3. Publish a security advisory describing the vulnerability, the affected versions, its severity, the fixed version and the recommended actions
4. Credit you in the advisory if you wish, or keep you anonymous if you prefer

Because our products are often deployed on isolated networks, customers retrieve updates from the Support Portal on a connected machine and transfer them to their network. We notify customers through the Support Portal and by email to their registered contact.

Where the law requires it, we notify the competent authorities (for example the European Union Agency for Cybersecurity and the national CSIRT) of vulnerabilities that are being actively exploited, and we may share information about the vulnerability with them. If the vulnerability lies in a third-party component, we may share the relevant details with its maintainer.

3. Coordinated disclosure

We ask that you give us a reasonable time to fix the vulnerability before making it public.

• Please do not disclose details publicly until a fix is available, or until 90 days have passed since your report, whichever comes first
• If we are actively working on a fix and need more time, we will ask you for an extension and explain why. We will agree on a date in good faith
• If a vulnerability is already being actively exploited, we may publish guidance and mitigation measures earlier to protect our customers, and we will inform you beforehand where possible

4. Scope

In scope: the Scaderis Software software products, in the versions for which we provide security support. The end date of the security support period for each major version is published on the Support Portal (https://support.scaderis-software.com), and is at least five years from the general release of that version.

Out of scope:

• Vulnerabilities in third-party products that are not part of Scaderis Scheduler (for example operating systems, database engines, or third-party equipment or software).
  Please report these to their respective vendors. If a third-party component that we ship is affected, we want to know about it
• Reports produced only by automated scanners, without a demonstrated impact on the product
• Issues that require physical access to the machine, or that depend on a configuration contrary to the security recommendations of our documentation (for example exposure of the Software directly to the Internet)
• Denial-of-service attacks based on traffic volume, social engineering, and phishing of our staff or customers

5. Rules for good-faith research

To stay within this policy, we ask that you:

• Test only on your own installation of the Software, or on a system you are authorized to test. Do not test systems that belong to our customers without their permission, and never test installations that control live equipment
• Avoid actions that could harm the availability or integrity of any system, process or equipment
• Do not access, modify, copy or keep more data than is strictly necessary to demonstrate the vulnerability, and do not send us personal data or customer data. If you come across such data, stop and tell us
• Do not exploit a vulnerability beyond what is needed to prove it, and do not share it with others before it is resolved

6. Legal safe harbor

If you act in good faith and follow this policy, we will consider your research to be authorized, we will not take legal action against you for it, and we will work with you to understand and resolve the issue. This commitment binds Scaderis SAS only, and cannot bind third parties or public authorities. It does not cover activities that are clearly malicious, that seriously harm others, or that breach this policy.

7. Rewards

We do not currently offer a monetary reward for vulnerability reports. We will gladly credit you for your contribution if you wish.

8. Contact

Scaderis Software SAS
105 rue des Mourettes, 26000 Valence, France
Email: (subject: "Security")