Coordinated Vulnerability Disclosure Policy (CVD)

Our Commitment to Cybersecurity

The security of our time synchronization and time display solutions is a priority. We encourage security researchers and independent experts to responsibly report any vulnerabilities they identify in our products. Our Coordinated Vulnerability Disclosure (CVD) Policy explains how to report vulnerabilities and how we review, address, and communicate them, so they can be investigated and resolved appropriately while helping protect users of our solutions.

Policy Scope

This policy applies to Gorgy Time products that are still supported. Depending on the product, this may include firmware, web interfaces, associated software, and hardware components. To check whether your equipment is still supported, please refer to the support information available for the product in question.

How to Report a Vulnerability

To report a vulnerability, please use the form below and provide, where possible, the information needed to reproduce and investigate the issue: the affected product and version, a description of the issue, its potential impact, steps to reproduce it, and any relevant technical details.

Response and Handling Times

We aim to acknowledge reports within two business days and provide an initial response within ten business days. The time needed to investigate a vulnerability and develop a fix depends on its nature, severity, and the products affected. We keep the person who reported the issue informed of progress and work with them on the disclosure timeline.

Coordinated Disclosure and Publication

Before any information is published, our technical team investigates the vulnerability to assess its impact and identify the products affected. If a fix is needed, it is developed and tested before being made available. We then inform affected users of any steps they should take, depending on the nature of the vulnerability. If more time is needed to complete the fix or secure the affected products, we let users know and discuss the next steps.

Responsible Security Research

Gorgy Time encourages responsible vulnerability reporting. When a researcher acts in good faith and follows the rules below, Gorgy Time does not intend to pursue legal action against them for research activities carried out under this policy, to the extent permitted by applicable law.

Researchers must, in particular:

• limit testing to what is necessary to identify and demonstrate the vulnerability;
• not alter, destroy, or disrupt data or systems;
• not access, copy, or disclose data beyond what is strictly necessary to report the vulnerability;
• not exploit the vulnerability for personal gain or for the benefit of a third party;
• not publicly disclose the vulnerability before the agreed coordination period has ended, unless prior approval has been given;
• report the vulnerability promptly through one of our official channels and cooperate in good faith with its investigation.

Confidentiality and Communication

Information received in a report is used only to investigate the vulnerability, develop a fix, and prepare for disclosure. The identity of the person who submitted the report will remain confidential and will not be shared with third parties without their consent, unless required by law. When necessary, Gorgy Time informs affected customers about the vulnerability and provides available fixes or steps they can take to protect their equipment.

Responsible Reporting

To help improve the security of our products, research must be carried out responsibly. Testing must not involve unauthorized access to production systems, modification or destruction of data, or extraction of personal data. Denial-of-service attacks, social engineering attempts, and any use of a vulnerability for malicious or financial gain are not permitted under this policy.