Thank you for helping us keep our products secure. This document explains how you can report a security vulnerability you have found in a product from KIDE, S. Coop. (hereinafter, KIDE), and what you can expect from us afterwards.
Our commitment
KIDE values collaboration with the security community, customers and independent researchers to identify and address vulnerabilities in our products. We undertake to handle in good faith every report received in accordance with this policy, without taking legal action against anyone who reports a vulnerability responsibly and complies with the terms set out here.
Scope
This policy applies to the connected products with digital elements developed and marketed by KIDE, as well as their associated software and firmware components.
This policy does not cover third-party systems not operated by KIDE, social engineering attacks against our staff or customers, or testing that could impair the availability of our customers’ production installations (for example, denial-of-service attacks). If you are unsure whether a finding falls within scope, please report it anyway: we will assess it.
How to report a vulnerability
You can report a vulnerability through the following channel:
- Web form: available in the “Security” section of www.kide.com, with the fields needed to describe your finding.
Please include, where possible: the affected product and version; a description of the issue and how it can be exploited; the steps to reproduce it; and, if available, screenshots, logs or proof-of-concept code.
You can report anonymously. Please note that if we need to contact you to clarify details or coordinate disclosure, we will be unable to do so unless you provide contact details.
What you can expect from us
| Milestone | Our commitment |
|---|---|
| Acknowledgement of receipt | Within a maximum of 3 business days of receiving your report, we will confirm receipt and assign you a tracking reference. |
| Initial assessment | Within a maximum of 10 business days, we will let you know whether we have been able to confirm the vulnerability and what priority we have assigned to it. |
| Progress updates | While we work on a fix, we will keep you regularly informed of progress, at least every 30 days while the case remains open. |
| Resolution and disclosure | Once a fix is available, we will publish a security advisory and notify you, together with the agreed acknowledgement. |
Embargo policy (coordinated disclosure)
We ask that you do not publicly disclose or share details of the vulnerability with third parties until we have published a fix or mitigation measure, or until 90 calendar days have elapsed since your initial report, whichever comes first. This period may be shortened or extended by mutual agreement between KIDE and the reporting person, taking into account the complexity of the fix and whether the vulnerability is being actively exploited.
If the vulnerability is being actively exploited or poses a serious and imminent risk to our customers, KIDE may expedite publication of an advisory and the corresponding mitigation measures, even before a definitive fix is available.
Publication of the security advisory
Once a fix is available, we will publish a security advisory in the “Security advisories” section of our website, describing the vulnerability, the affected product and versions, its severity, and instructions for applying the fix or mitigation measure.
Acknowledgement
If you wish, we will include your name or alias in the published security advisory to thank you for your contribution. If you prefer to remain anonymous, we will respect your decision.
KIDE does not offer financial rewards. Acknowledgement is limited to a public thank-you in the vulnerability report if you wish to be included.
Contact
For any questions about this policy, please email security@kide.com.
Last updated: 16/09/2026
