Jonsson is committed to maintaining the security of its products and supporting coordinated vulnerability disclosure.
We welcome reports from security researchers, customers, suppliers, partners, and other parties regarding potential security vulnerabilities affecting Jonsson products.
The purpose of this policy is to explain how vulnerabilities can be reported to Jonsson, how such reports are handled, and what reporters can expect during the vulnerability management process.
Potential vulnerabilities affecting Jonsson products should be reported through one of the following channels:
Report a Vulnerability
Email: info@pjjonsson.se
The Report a Vulnerability section contains a vulnerability reporting form and is the preferred method for submitting vulnerability reports and supporting information.
The reporting form allows reporters to provide product information, affected versions, technical details, reproduction steps, supporting evidence, attachments and other relevant information needed to assess the reported issue.
Providing complete and accurate information helps Jonsson assess and address the reported issue efficiently.
Jonsson supports responsible security research conducted in a manner that protects customers, products and operational environments.
Individuals reporting vulnerabilities are expected to:
Jonsson will not initiate legal action against any individual who reports security vulnerabilities in good faith and in accordance with this policy.
This applies where the individual:
If sensitive information is unintentionally accessed during testing, it must not be stored or shared and must be reported to Jonsson immediately.
Upon receiving a vulnerability report, Jonsson will:
The handling and prioritization of vulnerabilities depend on factors including severity, exploitability, product lifecycle status, operational impact, and technical complexity.
Vulnerabilities confirmed as valid and affecting Jonsson products are assessed using Jonsson’s product security risk assessment process.
Based on this assessment, Jonsson determines appropriate actions to address the vulnerability. These may include:
All confirmed vulnerabilities are tracked through the vulnerability management process until resolution, mitigation, or formal closure.
When a vulnerability is addressed, Jonsson may publish a Security Bulletin to communicate relevant information to customers and partners.
Security Bulletins provide customers with relevant technical and remediation information related to resolved vulnerabilities.
Security Bulletins may include:
Jonsson follows a coordinated vulnerability disclosure approach to support customer protection and responsible handling of security issues.
Jonsson will coordinate with vulnerability reporters where appropriate to align on the timing and content of public disclosure once a vulnerability has been assessed and remediation or mitigation is available or planned.
Public disclosure of vulnerability details should not occur before Jonsson has had a reasonable opportunity to:
This policy applies to Jonsson products and software that are within their active support lifecycle.
The following are generally outside the scope of this policy:
Vulnerabilities affecting third-party products should be reported to the respective vendor. If a third-party component is integrated into an Jonsson product, the issue may be assessed within the context of the Jonsson product.
Information submitted through vulnerability reports is treated as confidential and is shared only on a need-to-know basis with personnel involved in assessing, remediating or communicating the vulnerability.
Sensitive technical details, including proof-of-concept material and supporting documentation, are handled securely throughout the vulnerability management process.
Information is disclosed externally only when a Security Bulletin or other coordinated communication is published by Jonsson.
Jonsson acknowledges the contribution of individuals who responsibly report security vulnerabilities.
Where appropriate and with the reporter’s consent, Jonsson may include an acknowledgement in a Security Bulletin. This may include the reporter’s name or an agreed alias.
Jonsson does not operate a bug bounty program and does not provide monetary rewards for vulnerability submissions.
For questions regarding this policy or product security matters, please contact info@pjjonsson.se
