This is StreamSec HB's policy on coordinated vulnerability disclosure: how to tell us about a vulnerability in one of our products, what we do with the report, and when the details become public. It is the policy that Annex I, Part II, point (5) of Regulation (EU) 2024/2847, the Cyber Resilience Act, asks a manufacturer to put in place and enforce.

IN SHORT

• Report to support@streamsec.se. Every report is read on the day it arrives.
• Fixes are free source patches, published as fast as practically possible in the Announcements section of our support forum, each with an advisory.
• Severity is given as a CVSS v4.0 score in every advisory.
• Identifiers are the releases affected and our own patch number; we do not use CVE identifiers.

SCOPE

This policy covers every StreamSec product. A report about any of them is welcome, whichever release you have. Reports about our websites are welcome at the same address, although the rest of this policy is written for the products.

What a report can lead to depends on the copy. Security updates are issued for licensed releases within their support period, which runs for five years from each release's own publication date (PRODUCTINFO.txt, section 7). An evaluation copy is not covered, but it is built from the same source as its release, so a flaw found in a trial is handled as a flaw in that release.

A vulnerability in the product is a flaw in what the product itself does: wrong behaviour in complete code, which an attacker can use under practical conditions. The following are not, and are answered with documentation or migration advice rather than a security update:

• an algorithm, scheme or protocol that has become obsolete, the arrival of a quantum computer, or a default that was right when the release shipped (PRODUCTINFO.txt, section 7);
• a consequence of a decision the application makes, such as an event handler that accepts a certificate or host key the library reported as failing verification (PRODUCTINFO.txt, section 5);
• the absence of something the product does not claim to provide (PRODUCTINFO.txt, section 4).

An implementation error in a deprecated algorithm is still a flaw in the product, and it is fixed like any other while the release is in support.

HOW TO REPORT

By email to support@streamsec.se, in English or Swedish. It is our single point of contact for vulnerabilities: a monitored address that reaches the people who maintain the code. Every report sent there is read on the day it arrives.

What to send. The product and its version string (PRODUCTINFO.txt, section 3), the platform and the Delphi version, what you observed, and — if you have one — the smallest input or sequence that reproduces it. If you believe the vulnerability is being exploited, say so in the subject line.

WHAT HAPPENS TO A REPORT

We read it the same day, acknowledge it, and reproduce it or tell you why we cannot.

We trace what an attacker could do with it — the position they need, what they control, each precondition in the code, and what they end up with — before we class the fix as a security update. A security update obliges every affected integrator to rebuild and redeploy, so that classification rests on the traced path, not on the shape of the flaw. A defect that does not meet the bar is still fixed, in an ordinary release, and recorded in CHANGES.txt.

A vulnerability is fixed as fast as practically possible, for every release in its support period that it affects. The fix is a free source patch, issued on its own and separate from new functionality, as described in section 8.3 of PRODUCTINFO.txt, and it is published as soon as it is ready.

Until the fix is published, the report goes no further than the law requires: to the maintainer of an affected third-party component, and, if the vulnerability is being actively exploited, to the authorities to whom Article 14 of the Cyber Resilience Act obliges us to report it. Customers are not contacted before a fix is published, except where Article 14 requires us to warn the users of an actively exploited vulnerability sooner.

PUBLICATION

A fix is published as soon as it is ready, with an advisory. The date is not agreed with the reporter. We ask you not to publish the details yourself before the fix is out.

Where. As a topic in the Announcements section of our support forum, which anyone can read without an account. Each advisory and patch stays available there for at least ten years. Once a fix is published, we also contact the affected users we can identify.

What an advisory says. A description of the vulnerability; the releases it affects, so that you can tell whether your copy is one of them; its impact; its severity, as a CVSS v4.0 score with the vector it was computed from; and what to do about it.

Identifiers. An advisory is identified by the releases it applies to and our own patch number — P01, P02 and so on, counted per release. We do not assign or request CVE identifiers.

A delayed advisory. Where publishing the details at once would put users at more risk than it protects them, we may hold the details back until users have had the opportunity to apply the fix, as Annex I, Part II, point (4) of the Cyber Resilience Act allows. The fix itself is not held back.

Credit. The advisory names the reporter, unless the reporter asks not to be named.

THIRD-PARTY COMPONENTS

The software bill of materials (PRODUCTINFO.txt, section 10) lists the third-party code the product contains. Report a vulnerability in any of it to us in the same way. We report it to the component's maintainer, share our fix with them, and remediate it in our product as we would our own code, as Article 13(6) of the Cyber Resilience Act requires.

RESEARCHING OUR PRODUCTS

We will not take legal action against anyone who researches a StreamSec product in good faith, on a copy they are licensed to use, and reports what they find to us under this policy before making it public. This does not extend to testing against our websites or servers.

We do not run a bug bounty programme.

THIS DOCUMENT

The same policy ships as SECURITY.txt in the root of every StreamSec Tools distribution released after 4.1.4.360.