Responsible Disclosure Guidelines

Here are guidelines on how you can report vulnerabilities to us directly.

What is Responsible Disclosure?

SKY is committed to resolving security vulnerabilities quickly and carefully.

If you believe you have discovered a security related issue with our systems, we would appreciate your help in investigating the issue by disclosing the issue to us.

Any disclosures you make to us will be dealt with responsibly and confidentially.

What is the process?

Contact us through the form with a detailed report of the potential vulnerability.

You should include as much of the following as possible:

• Type of vulnerability.
• Whether the information has been published or shared with others.
• Affected products and versions.
• Affected configurations.
• Step-by-step instructions/proof-of-concept codes to replicate the issue.

Once submitted, we will acknowledge that we have received your report with a non-automated reply within 5 working days and provide an outline response plan where applicable.

We will then review the information and work to validate the reported vulnerability. In the event that a true vulnerability is discovered we will complete the investigation and notify the reporter once our investigation has been concluded. Where appropriate (but taking into account our confidentiality obligations) the reporter will receive an outline of our findings.

What SKY will expect from you.

So that we may protect the security of our customers we request that any potential vulnerability that you believe you have discovered is not shared outside of trusted circles, until we have had the opportunity to research, respond and address the reported vulnerability and inform customers if needed.

We do not permit the following types of security research:

• Causing, or attempting to cause, a Denial of Service (DoS) condition
• Accessing, or attempting to access, data or information that does not belong to you
• Destroying or corrupting, or attempting to destroy or corrupt, data or information that does not belong to you

We also ask that you do not share or post any information belonging to our customers or suppliers in any environment. We aim to address all valid vulnerabilities that are brought to our attention as quickly as possible.

What to expect from SKY.

If you act in good faith and follow this policy then we make the following commitments to you:

• The information that you share with us as part of this process will be kept confidential within SKY and our directly contracted suppliers.
• It will not be shared with third-parties without your permission.