Cyber Security reporting

How to report a vulnerability

You can contact us through one of the following channels. They are DAVE's single point of contact for reporting and receiving information about vulnerabilities in our products.

Web reporting form

fill in the form with a description of the issue, which you will find at the bottom of this page. It is the recommended channel for a structured report.

Dedicated email

security@dave.eu

We reply in Italian and in English.

What to include in the report

To help us understand and reproduce the issue as quickly as possible, we ask you to indicate, as far as possible:

• the affected product (commercial name/code, hardware and/or firmware version, serial number if available);
• a description of the vulnerability and its potential impact;
• the steps to reproduce the issue (proof of concept, commands, requests, configuration);
• any prerequisites or conditions required for exploitation;
• logs, screenshots, photos, files or code useful for the analysis;
• your contact details for follow-up communication (optional, if you wish to be kept updated or credited);
• whether you believe the vulnerability is already known or already disclosed, or whether you have already informed third parties (e.g. CVE, CSIRT, other vendors).
• whether you believe the vulnerability is already being actively exploited

A complete exploit is not required: even a clear description of the issue is useful.

Rules of conduct ("safe harbor")

DAVE Embedded Systems considers security research conducted in good faith to be a valuable contribution. We will not take or support legal action against anyone who reports a vulnerability, provided that, in the research activity and in the report, you:

• comply with this policy and act in good faith;
• avoid privacy violations, destruction or alteration of data, and interruption or degradation of our services;
• do not access, copy or retain personal or confidential data of third parties beyond the minimum necessary to demonstrate the vulnerability, and delete it once the report is concluded;
• do not exploit the vulnerability beyond what is necessary to verify its existence (no data exfiltration, lateral movement, malware installation, etc.);
• do not publicly disclose the vulnerability before it has been resolved and before you have agreed the disclosure timeline with us (see below);
• comply with applicable laws.

Activities that cause intentional harm, extortion, access to unnecessary data and any unlawful conduct are excluded from the "safe harbor". If in doubt, contact us before proceeding: we will assess together how to move forward.

Public disclosure

We prefer coordinated disclosure: the details are published only after a fix or mitigation is available to users, and in agreement with the person who reported the vulnerability.

As a general reference, we adopt a window of 90 days from acknowledgement to make a fix available, extendable by mutual agreement in more complex cases. When appropriate, we will publish a security advisory on our website.

Acknowledgements

Unless you indicate otherwise, we will be glad to publicly credit those who have helped us improve the security of our products, indicating your name (or pseudonym) in the security advisories. If you prefer to remain anonymous, we will respect your choice.

At present no financial reward programme (bug bounty) is provided.

Scope

This policy applies to products with digital elements manufactured by DAVE S.r.l. and to the services and infrastructure directly managed by DAVE.

If the vulnerability concerns a customer's product that integrates DAVE components, or a third-party component present in our products, contact us anyway: we will coordinate the handling with the responsible party.