TOTANI PSIRT
In accordance with the principles of Coordinated Vulnerability Disclosure (CVD), TOTANICorporation establishes this policy as set out below, with the aim of enhancing the security and reliability of the products and services we provide by cooperating with vulnerability reporters, other affected organizations and relevant authorities, and handling vulnerability information through an appropriate and transparent process.
Vulnerability reports shall be accepted at the official contact desk (web form). The official contact desk and related information shall be published on the TOTANI website and elsewhere to ensure that reporters can contact us safely and securely.
Once a vulnerability report is submitted, a notification confirming receipt of the report shall be sent to the reporter within three business days. We may request additional information as necessary to confirm details and better assess the vulnerability.
Vulnerability information shall not be disclosed until remediation measures are finalized and the issue is disclosed to the public, and the vulnerability information shall not be shared with anyone other than the reporter, affected organizations, and other relevant parties. Information shall be handled in accordance with a non-disclosure agreement (NDA) and statutory requirements.
In the event that a vulnerability is discovered to affect a product manufactured or sold by TOTANI, and if that may in turn also affect other products and services, TOTANI shall coordinate with the appropriate authorities and determine overall remediation measures and the timing of any public announcements.
Vulnerability remediation measures (e.g., patches, workarounds) shall be promptly developed and tested, and information on progress shall be shared as necessary with the reporter and relevant parties.
We shall aim to reach a reasonable agreement through discussion with reporters, relevant vendors, etc. on when to publicly release vulnerability information and remediation measures. As a general rule, vulnerability information shall be released to the public in an appropriate way after an agreement is reached among relevant stakeholders. However, in the event that real damage has been incurred, or in special circumstances including difficulty reaching an agreement, we may choose to make an exceptional early disclosure of the vulnerability as per the FIRST (Forum of Incident Response and Security Teams) recommended guidelines.
When disclosing vulnerability information, we shall clearly describe the necessary technical details, scope of impact, and response measures from a risk mitigation perspective. If the reporter asks to receive credit for the vulnerability report, we shall clearly give credit for their contribution. The content of the disclosure shall be designed with due consideration for the security of users and society as a whole.
If a reporter discovers a vulnerability, whether intentionally or accidentally, through honest and lawful means and without intent to attack or exploit, the reporter shall not be unfairly held liable or subjected to any form of retaliation for their report.
Records shall be maintained for the coordinated vulnerability disclosure process and used to improve process effectiveness and make other continuous improvements.
To report a vulnerability related to TOTANI products or Application,
please contact us through the dedicated PSIRT reporting form.
Report a Vulnerability
