Coordinated Vulnerability Disclosure Policy — Vivaldi s.r.l.

Coordinated Vulnerability Disclosure Policy

Vivaldi s.r.l. · Last updated: 2026-08-01 · Languages: English, Italiano
Vivaldi s.r.l. welcomes reports of security vulnerabilities in its products with digital elements. This policy explains how to report a vulnerability, what to expect from us, and the conditions under which we will not pursue legal action against good-faith security research. It is published in line with our obligations under the EU Cyber Resilience Act (Regulation (EU) 2024/2847).

Scope

This policy applies to Vivaldi s.r.l. hardware and firmware products and the services we operate to support them. Third-party components are in scope only as integrated and distributed by Vivaldi s.r.l.; vulnerabilities in upstream software should also be reported to the respective upstream project.

How to report

• Email: security@vivaldigroup.it
• Encrypt sensitive reports with our published key, when available.
• Use English or Italian.

Please include: affected product and firmware version, a description of the issue and its impact, step-by-step reproduction details, and any proof-of-concept material. Do not include third-party personal data.

Our commitment

• We acknowledge receipt within 3 business days.
• We provide an initial assessment, including whether the report is accepted, within 10 business days.
• We keep you informed of remediation progress and the planned fix or mitigation.
• With your consent, we credit you once the issue is resolved.

Coordinated disclosure

We ask that you give us reasonable time to remediate before any public disclosure, and that we coordinate the timing and content of any publication. Our default target is up to 90 days from acknowledgement, which may be shorter for actively exploited issues or longer for complex fixes, by mutual agreement.

Safe harbour

We will not pursue or support legal action against research conducted in good faith and in accordance with this policy. Good-faith research means you:

• avoid privacy violations, data destruction, and interruption or degradation of our services;
• access only the minimum data necessary to demonstrate the issue, and do not exfiltrate, retain, or disclose it;
• do not use social engineering, physical attacks, or denial of service;
• give us a reasonable opportunity to remediate before disclosure.

Out of scope

Reports without a demonstrable security impact (for example, missing hardening headers without an exploit, theoretical issues, or output from automated scanners without validation) may be acknowledged but de-prioritised.

Relationship to regulatory reporting

Where a reported vulnerability is being actively exploited, or causes a severe incident affecting the security of our products, Vivaldi s.r.l. notifies the relevant authorities through the ENISA single reporting platform as required by Article 14 of the Cyber Resilience Act. Reporter identity is not shared without consent except where legally required.

Contact of last resort

If you do not receive a response within the timelines above, you may escalate to your national CSIRT.