Vulnerability Information Disclosure Policy

Purpose

BMTech is committed to maintaining the security of our products and services. We encourage customers, security researchers, and members of the security community to responsibly report potential security vulnerabilities so they can be investigated and addressed in a timely manner.

This policy explains how to report security vulnerabilities, how BMTech handles vulnerability reports, and how we communicate with reporters throughout the process.

Scope

This policy applies to security vulnerabilities affecting products, firmware, software, cloud services, websites, and other systems developed or maintained by BMTech.

Reports relating solely to third-party products or services that are not developed or maintained by BMTech should be directed to the appropriate vendor whenever possible.

Reporting a Vulnerability

If you believe you have identified a security vulnerability in a BMTech product or service, please report it by sending an email to cybersecurity@bmtech.com.

To help us investigate your report, please include as much of the following information as possible:

• The affected product or service
• Product model, firmware version, or software version (if applicable)
• A description of the vulnerability
• Steps to reproduce the issue
• Proof-of-concept code, screenshots, logs, or other supporting information
• The potential security impact
• Your preferred contact information

Report Handling

After receiving your report, we will:

• Acknowledge receipt of your report within 5 business days.
• Review the report to determine whether it describes a security vulnerability.
• Investigate confirmed vulnerabilities and assess their potential impact.
• Develop and implement appropriate remediation measures based on the assessed risk.
• Coordinate with internal teams and external partners, as appropriate.

If additional information is required during the investigation, we may contact you for clarification.

Communication

We value constructive collaboration with security researchers and will keep reporters informed throughout the investigation process.

For confirmed vulnerability reports, we will provide status updates at least every 14 days until the investigation has been completed or the report has been closed.

If we determine that the reported issue is not a security vulnerability or falls outside the scope of this policy, we will notify you.

Coordinated Disclosure

We encourage responsible, coordinated disclosure of security vulnerabilities.

We ask that reporters refrain from publicly disclosing a vulnerability until BMTech has had a reasonable opportunity to investigate the issue and develop appropriate mitigations. We will work with reporters to coordinate public disclosure when appropriate.

Where appropriate, BMTech may request a Common Vulnerabilities and Exposures (CVE) identifier through an authorized CVE Numbering Authority (CNA) or coordinate with the reporting researcher or another appropriate organization.

Good-Faith Security Research

BMTech welcomes vulnerability reports submitted in good faith.

We will not pursue legal action against individuals who:

• Act in good faith to identify and report security vulnerabilities.
• Avoid actions that could unnecessarily disrupt our products, services, or customers.
• Do not intentionally access, modify, or retain data beyond what is reasonably necessary to demonstrate the vulnerability.
• Do not exploit a vulnerability for malicious purposes or personal gain.
• Provide BMTech with a reasonable opportunity to investigate and address the issue before public disclosure.

Activities that violate applicable laws or intentionally harm BMTech, its customers, or third parties are not covered by this policy.

Public Disclosure

When appropriate, BMTech may publish information about confirmed vulnerabilities together with available mitigations, software updates, or other recommended actions.

With the reporter's consent, we may acknowledge individuals or organizations that have responsibly disclosed vulnerabilities and contributed to improving the security of our products and services.

We appreciate the efforts of the security community in helping us improve the security of our products and services.

Last Updated

May 1, 2026