Skip to content
  • There are no suggestions because the search field is empty.

Vulnerability disclosure policy

Found a vulnerability

If you believe you have found a security vulnerability in a Holm Security product, we want to hear from you. This article explains how to report it and what you can expect from us.

Scope

What is in scope

This policy covers the following in the Holm Security VMP (Vulnerability Management Platform):

  • Web-based portals:
    • Security Center
    • Organizer
    • Partner Portal
  • Software:
    • Scanner Appliance
    • Device Agent for Windows
    • Holm Security VMP | OnPrem – core machine
    • Holm Security VMP | OnPrem Air-Gapped – core machine

What is out of scope

  • Vulnerabilities in third-party products or services. Please report these to the vendor directly.

  • Findings that require physical access to a device or a user's unlocked computer.

  • Reports from automated tools without proof of a real security impact.

  • Social engineering or phishing of Holm Security employees, customers or partners.

  • Denial of service attacks. 

How to report a vulnerability 

Email us at security@holmsecurity.com. If your report contains sensitive details, tell us in your first email and we will arrange a secure way to share them.

To help us act quickly, please include:

  • The product and version affected.

  • A description of the vulnerability and its potential impact.

  • Steps to reproduce it, including any proof of concept.

What you can expect from us

When you report a vulnerability, we will:

  • Confirm we received your report within 3 business days

  • Share our initial assessment within 10 business days

  • Keep you informed as we investigate and fix the issue

  • Agree with you on a date for public disclosure

  • Where required by law, we report actively exploited vulnerabilities to the relevant authorities. This includes our obligations under the EU Cyber Resilience Act.

Guidelines for researchers

We ask that you:

  • Give us reasonable time to fix the issue before you share it publicly. We aim to resolve reported vulnerabilities as quickly as possible, but no later than 90 days after we received the report.  

  • Only access the data you need to show the vulnerability. Do not view, change or delete data that belongs to others.

  • Stop testing and contact us if you encounter customer data.

  • Do not test against customer environments or systems you do not own.

  • Do not disrupt our services or degrade the experience for our users.

Other details

Safe harbor

If you act in good faith and follow this policy, we will not take legal action against you for your research.  

Rewards

We do not run a paid bug bounty program at this time.  

Security advisories

We publish security advisories for our products in the product security notices article.

Contact

Email: security@holmsecurity.com