Reporting security vulnerabilities

Scope

This page describes how to report a security vulnerability in QENEX products: the QInsight application including the QENEX Suite platform, the QFW SDK library, the licensing service and the account.qenex.net portal.

How to report a vulnerability

Write to security@qenex.net, in Czech or English. Please include:

1. the product and its version,
2. a description of the vulnerability and its possible impact,
3. the steps to reproduce it, and where available a sample project, script or log excerpt,
4. a contact for follow-up questions.

How we handle your report

1. We acknowledge receipt within 5 business days.
2. We investigate the report and tell you the result.
3. We fix a confirmed vulnerability in a new version and list the fix in the release notes.

What we ask of you

1. Do not publish details of the vulnerability before we release a fix.
2. Test only on your own accounts, licenses and devices.
3. Do not access other users' data and do not degrade the availability of the service.
4. Do not include personal data of third parties in the report.

Issues without security impact

Send issues without security impact and questions about using the products to info@qenex.net.

Security advisories

No security advisory has been issued for QENEX products so far. Advisories about fixed vulnerabilities will be published on this page.