Vulnerability Disclosure Policy (VDP)

1. Introduction

This document establishes the official Vulnerability Disclosure Policy (VDP) framework for ICP Group. The purpose of this policy is to provide clear guidelines for security researchers, ethical hackers, and users to safely identify and report potential security vulnerabilities within our products, systems, and services. In accordance with Article 14 of the Cyber Resilience Act (CRA), this policy ensures a structured pipeline for capturing, assessing, and reporting actively exploited vulnerabilities to European authorities (ENISA and national CSIRTs) within the mandated timelines.

2. Vulnerability Disclosure

2.1 Rules of Engagement

To safeguard both our infrastructure and our users, we ask all individuals conducting security research to adhere to the following principles:

  • Safe Testing: Report discovered vulnerabilities directly to us and do not disclose them publicly until a fix has been successfully deployed (Coordinated Disclosure).
  • No Exploitation: Avoid actions that exceed what is strictly necessary to demonstrate the flaw. Do not exfiltrate data, disrupt operational systems, or deploy malware.
  • Privacy Protection: If you accidentally encounter personal data or proprietary business data during your research, delete it immediately and cease further exploration.

2.2 Reporting Procedure

If you identify a security issue, please compile a report and securely transmit it to our Product Security Incident Response Team (PSIRT) via This email address is being protected from spambots. You need JavaScript enabled to view it.. Your report should contain the following critical points:

  • Product Details: Product name, hardware revision, and firmware or software version.
  • Technical Breakdown: A comprehensive description of the flaw, accompanied by a reproducible step-by-step Proof of Concept (PoC), screenshots, or raw logs.
  • Exploitation Status (CRA Critical): Indicate explicitly whether this is a newly discovered theoretical flaw, or if you have evidence that the vulnerability is currently being actively exploited "in the wild" by malicious actors.

⚠️ CRITICAL ESCALATION NOTICE (CRA Article 14):
If your findings indicate that the vulnerability is being actively exploited in production environments, please prefix your email subject line with: [URGENT: CRA ACTIEF MISBRUIK]. This will fast-track your report through our 24-hour response triage.

2.3 What to expect

Upon receipt of a submission, our PSIRT activates an incident management sequence designed to meet European statutory demands:

  • Acknowledgment: A confirmation of safe receipt and a preliminary validity assessment will be shared within 5 business days.
  • Statutory Triage: We immediately evaluate whether the vulnerability qualifies as an actively exploited flaw or a severe incident under Article 14 of the CRA. If triggered, a notification is sent to ENISA and relevant national regulators within 24 hours.
  • Remediation and Collaboration: Our team will work closely with you to address the root cause and will keep you informed of our mitigation timelines and upcoming security updates.
  • Safe Harbor: If you fully abide by the rules outlined in this VDP, we commit to not pursuing legal action (civil or criminal) regarding your research activities.