Security Reporting Rules

Responsible Vulnerability Reporting Rules

These rules define how security reports relating to products supplied by FIBRAIN should be submitted and the standard of conduct expected from the reporting party.

These rules apply both to reports submitted directly through the portal and to reports transferred into the portal automatically from forms published by FIBRAIN or HALNy Networks, including the form available at `halny.com/security`.

Core Principles
01 Report only what you are authorized to assess
02 Do not disrupt systems, networks or devices
03 Limit data handling to the minimum necessary
04 Do not disclose details publicly before coordination is complete
1. Scope Of Reports
  • authentication and authorization flaws,
  • vulnerabilities affecting firmware, software and related services,
  • remote code execution, privilege escalation or information disclosure issues,
  • security-impacting misconfigurations,
  • other issues that may weaken the confidentiality, integrity or availability of the product.
2. Information To Include
  • manufacturer, product name and model,
  • firmware or software version,
  • description of the issue and reproduction steps,
  • possible impact and attack scenario,
  • logs, screenshots or supporting evidence needed for assessment.
3. Prohibited Practices

Prohibited

  • social engineering, phishing and impersonation,
  • physical or destructive testing,
  • modifying, copying or deleting data beyond what is necessary to document the issue,
  • actions that disrupt customer, operator or network environments.

Expected

  • good-faith conduct,
  • private disclosure through the portal or through an external FIBRAIN or HALNy form,
  • cooperation when clarification is requested,
  • refraining from public disclosure until assessment is complete or a publication approach has been agreed.
4. Coordination And Communication

FIBRAIN may request additional information, confirmation of the test environment or supporting evidence. For third-party products, FIBRAIN may coordinate handling with the relevant manufacturer or technical partner.

Receipt of a report does not automatically confirm the existence of a vulnerability. Each case is assessed on its own technical and organizational merits.

5. Legal And Organizational Context

The portal and reporting process support FIBRAIN's product security activities, vulnerability handling processes and coordination with manufacturers and technical partners.

Where a report is transferred from an external form, the acceptances and statements made before that form is submitted become part of the reporting process handled through the portal.

Report Confidentiality

The reporting party submits information on a confidential basis and with due care. FIBRAIN expects that vulnerability details will not be publicly disclosed until appropriate assessment and remediation steps have been taken or a publication approach has been agreed.

Last updated: July 31, 2026.