Scope
This policy applies to OJ Electronics products with digital elements, including associated software and firmware.
Out of scope
Examples not considered vulnerabilities:
- Missing security headers (low-risk)
- DoS attacks requiring unrealistic resources
- Issues already publicly known
Reporting a vulnerability
If you are a user of an OJ Electronics product and have identified a vulnerability, please report it to: security@ojelectronics.com
Please include a clear description, affected product and version, steps to reproduce, potential impact, and any supporting documentation. Also provide your name and email address.
Handling of reported vulnerabilities
OJ Electronics will acknowledge receipt within 3 business days. Following an initial assessment, we will maintain active communication with the reporter and address confirmed vulnerabilities without undue delay.
Coordinated Vulnerability Disclosure
OJ Electronics follows a coordinated vulnerability disclosure approach. Vulnerabilities should be reported privately and disclosure will be coordinated after remediation or mitigation is available.
Safe harbour
OJ Electronics supports responsible security research and will not pursue legal action against individuals acting in good faith without causing harm or compromising systems.
Security advisories
OJ Electronics may publish security advisories including vulnerability details, affected products, and remediation guidance.
Regulatory reporting
In accordance with the Cyber Resilience Act, actively exploited vulnerabilities may be reported to authorities within defined timelines by regulation.
Continuous improvement
OJ Electronics continuously improves its vulnerability management processes in line with EU regulations and industry best practices.