Policy

1. Product Security Principles

Hypermicron considers information security an essential element of product development, deployment, and maintenance. We are committed to protecting our customers, partners, and stakeholders by proactively identifying security risks and implementing appropriate measures to address potential vulnerabilities.

We welcome collaboration with security researchers, customers, industry professionals, and business partners to identify and report potential security weaknesses in Hypermicron products and services. Through responsible vulnerability management and continuous security improvement, we aim to maintain the confidentiality, integrity, and availability of our products and solutions.

2. Security Issue Submission Guidelines

2.1 Contacting the Security Team

Anyone who discovers or suspects a security vulnerability in a Hypermicron product or service is encouraged to notify our security team through the designated reporting channel.

Security Contact: [email protected]

Email Subject Format: Security Issue – [Product Name] – [Brief Description]

Reports should contain sufficient information to help our team understand the issue, reproduce the reported behavior where possible, and determine the appropriate response.

2.2 Recommended Report Contents

To support an efficient investigation, reporters should include the following information whenever available:

• Reporter Details: Name, organization (if applicable), and preferred contact information.
• Issue Overview: A clear explanation of the suspected vulnerability, its nature, and its potential consequences.
• Product Identification: The affected product name, model, software or firmware version, and relevant operating environment.
• Technical Evidence: Reproduction instructions, supporting documentation, proof-of-concept code, screenshots, logs, or other relevant technical evidence, where available.
• Suggested Corrective Actions: Potential remediation approaches or temporary risk-reduction measures, if known.
• Disclosure Expectations: A proposed disclosure schedule or any relevant coordination requirements.

Hypermicron may request additional information when necessary to validate the report and evaluate the associated security risks.

3. Vulnerability Assessment and Resolution

3.1 Investigation and Response Activities

Hypermicron applies a structured approach to evaluating reported security issues and coordinating appropriate corrective actions.

1. Receipt Confirmation

Hypermicron aims to acknowledge each vulnerability report within 48 hours of receipt and initiate an internal assessment. Reports that may involve Critical or High severity issues will be given priority for prompt review.

2. Technical Investigation

The security team will examine the submitted information, verify the reported behavior, assess potential consequences, and assign an appropriate severity level based on the findings.

3. Progress Communication

Where appropriate, Hypermicron will provide the reporter with periodic updates regarding the investigation, assessment results, and planned remediation activities.

4. Corrective Action Planning

Following verification, Hypermicron will determine suitable corrective measures. Depending on the nature of the issue, these may include software or firmware patches, configuration adjustments, product updates, or temporary mitigation recommendations.

5. Remediation Verification

Proposed fixes will undergo appropriate testing and validation to confirm that the identified vulnerability has been addressed and that the corrective measures do not introduce unacceptable security or operational risks.

6. Security Advisories and Stakeholder Communication

When remediation becomes available, Hypermicron will communicate relevant information to affected customers or stakeholders as appropriate. Security advisories may include affected product information, recommended actions, available fixes, and interim mitigation guidance.

3.2 Target Resolution Schedule

Hypermicron aims to remediate confirmed vulnerabilities according to their assessed severity, using the following target timeframes from receipt of a valid vulnerability report:

• Critical and High Severity: Target resolution and release within 48 hours.
• Medium Severity: Target resolution and release within 3 business days.
• Low Severity: Target resolution and release within 7 business days.

These timeframes represent remediation targets and may depend on the technical complexity of the issue, the affected product, the availability of a suitable fix, and the scope of the required testing.

Issues involving open-source software or third-party components may require additional time because remediation can depend on external maintainers, upstream patches, third-party disclosures, or compatibility testing.

If an extended resolution period is necessary, Hypermicron will, where appropriate, explain the reason for the delay, communicate an estimated schedule, and provide interim mitigation recommendations when feasible.

4. Information Protection and Responsible Disclosure

Hypermicron handles vulnerability reports and related technical information confidentially. Access to sensitive information is limited to personnel who need it to investigate, assess, coordinate, or resolve the reported issue.

We support Coordinated Vulnerability Disclosure (CVD), which encourages affected parties and security researchers to work together toward remediation before information is made public.

Unless another schedule has been mutually agreed upon, Hypermicron requests that researchers refrain from publicly disclosing vulnerability details until the applicable 90-day disclosure period has elapsed.

All security research and testing activities should comply with applicable laws and regulations. Researchers are expected to avoid unauthorized access, service disruption, unnecessary exposure of sensitive information, privacy violations, and activities that could place Hypermicron, its customers, partners, or other parties at risk.

The following publications provide additional guidance on vulnerability disclosure and coordination:

• ISO/IEC 29147:2018 — Vulnerability Disclosure.
• The CERT® Guide to Coordinated Vulnerability Disclosure.

Hypermicron will protect sensitive vulnerability information in accordance with applicable legal, contractual, confidentiality, and privacy requirements. Information will not be disclosed to third parties except where authorized by the affected customer, reasonably necessary for coordinated remediation, or required by applicable law.

5. Continuous Improvement of Product Security

Hypermicron recognizes that maintaining cybersecurity requires ongoing assessment and improvement throughout the product lifecycle.

We are committed to strengthening the security and reliability of our products and services through appropriate security practices, vulnerability assessment, timely corrective action, and cooperation with relevant stakeholders.

All reported security issues will be reviewed with due diligence and handled according to their assessed severity, potential impact, and remediation requirements.

Our objective is to reduce security risks, improve product resilience, and provide customers with reliable solutions supported by responsible security management practices.

6. Security Maintenance and Product Lifecycle Support

Hypermicron aims to maintain the security and integrity of its products throughout their applicable support lifecycle. Security patches and updates may be provided to address identified vulnerabilities, mitigate emerging risks, and improve the overall security of supported products.

6.1 Product Security Support Duration

Hypermicron aims to provide security updates and patches for at least five years from the applicable product release date.

For products that have reached End of Life (EOL), security maintenance may continue for a defined period after the product discontinuation date, subject to the relevant product lifecycle policy, technical feasibility, and applicable support arrangements.

Additional information regarding product discontinuation and the availability of ongoing security maintenance will be communicated through official Hypermicron documentation or support channels, where applicable.

6.2 Release of Security Updates

Security updates may be issued on a regular schedule or when necessary to address identified vulnerabilities and emerging security concerns.

The timing and scope of an update will depend on factors such as vulnerability severity, the availability of a validated fix, product compatibility, and the potential impact on customers.

Issues presenting significant security risks will receive priority consideration during assessment and remediation.

6.3 Communication of Security Updates

Hypermicron will use appropriate official communication channels to inform customers and users about relevant security updates, available patches, and recommended protective measures.

Such channels may include:

• The official Hypermicron website.
• Security advisories and technical notices.
• Product documentation and customer support channels.
• Email notifications to affected customers or registered users, where applicable.

Customers are encouraged to review relevant security announcements, follow recommended mitigation measures, and install applicable updates in a timely manner.