Coordinated Vulnerability Disclosure (CVD) Policy

Email: [email protected]

Where possible, please include the following information:

Required Information

Product or Asset Information

• Product name
• Version number
• URL, API endpoint, or affected component

Vulnerability Description

• Vulnerability type (e.g., SQL Injection, Cross-Site Scripting, Remote Code Execution, Authentication Bypass, Privilege Escalation)
• Technical description of the issue

Reproduction Steps

• Clear, sequential instructions
• Required configuration or prerequisites
• Proof-of-concept code, scripts, screenshots, or logs where appropriate

Security Impact

• Potential impact on confidentiality, integrity, or availability
• Estimated severity or business impact, if known

Researcher Contact Information

• Name or preferred alias
• Email address for follow-up communication

 

1.3 Vulnerability Handling Process

Upon receipt of a vulnerability report, Evolving Systems will:

1. Log and acknowledge the report.
2. Assess whether the report is within scope.
3. Validate and reproduce the reported vulnerability.
4. Perform risk and severity assessment using industry-standard methodologies, including CVSS where applicable.
5. Assign the issue to the appropriate product engineering team.
6. Develop and test corrective actions, mitigations, or workarounds.
7. Coordinate remediation, customer communications, and release activities.
8. Issue security advisories where appropriate.

All reports will be handled confidentially and in accordance with our vulnerability management process.

 

1.4 Response Targets

Evolving Systems aims to meet the following service targets:

Actual remediation timelines may vary depending on:

• Severity of the vulnerability
• Product complexity
• Availability of corrective measures
• Impact on customers and production environments

 

1.5 Researcher Guidelines

Researchers are expected to:

• Act in good faith.
• Avoid privacy violations.
• Avoid accessing, modifying, destroying, or exfiltrating data.
• Avoid disruption of services or customer environments.
• Limit testing to the minimum necessary to demonstrate the vulnerability.
• Report vulnerabilities promptly after discovery.
• Maintain confidentiality until coordinated disclosure is agreed.

Researchers must immediately cease testing and notify Evolving Systems if customer data, personal data, or sensitive information is inadvertently accessed.

 

1.6  Safe Harbor

Evolving Systems will consider activities conducted in accordance with this policy to be authorized.

Evolving Systems will not pursue legal action against security researchers who:

• Act in good faith;
• Comply with this policy;
• Respect privacy and confidentiality;
• Avoid service disruption or damage;
• Promptly report discovered vulnerabilities.

This Safe Harbor does not apply to activities that:

• Violate applicable laws or regulations;
• Involve unauthorized access to customer environments;
• Cause harm, disruption, or data loss;
• Exceed the scope of testing reasonably required to identify and validate a vulnerability.

 

1.7 Customer Advisories and Coordinated Disclosure

Where a reported vulnerability is validated, Evolving Systems will, as appropriate:

• Develop a security patch or mitigation;
• Notify affected customers;
• Publish a security advisory;
• Coordinate public disclosure with the reporting researcher.

Public disclosure will normally occur only after:

• A corrective measure, mitigation, or workaround is available; or
• A reasonable remediation period has elapsed and affected parties have been informed.

 

1.8 Privacy

Personal information submitted as part of a vulnerability report will be processed solely for the purposes of investigating, managing, and resolving the reported security issue and in accordance with applicable data protection laws.

 

1.9 Contact Information

Product Security Team
Email: [email protected]

General Customer Support
Existing customers may continue to report product issues and vulnerabilities through their established support channels and customer Ticketing portal.