Introductory statement

At ViTrox Technologies Sdn. Bhd. and its affiliated companies ("ViTrox", "we", "our" or "us"), product security is important to us. ViTrox provides this designated vulnerability reporting channel for users, customers, security researchers, suppliers, partners and other third parties to report suspected security vulnerabilities affecting ViTrox products with digital elements. Reports are handled through a coordinated vulnerability disclosure process to support assessment, validation, remediation or mitigation, and, where appropriate, security advisories or other notifications.

Good Faith Conduct

ViTrox will not pursue legal action or voluntarily refer a researcher to law enforcement for security research conducted in good faith and in accordance with this policy, except where required by applicable law or regulatory obligations.

For purposes of this policy, "Good Faith Conduct" means security research where:

• testing is confined to systems, products or environments owned by the researcher or which the researcher is authorised to test, and does not extend to customer-deployed units or third-party systems without authorisation;
• the researcher does not access, modify, retain or exfiltrate data beyond what is reasonably necessary to demonstrate the vulnerability;
• the research does not intentionally disrupt product availability, systems or services; and
• the researcher complies with the Disclosure Policy below, including allowing ViTrox a reasonable opportunity to assess and address the reported vulnerability before public disclosure.

ViTrox may assess, acting reasonably and in good faith based on the available circumstances, whether conduct constitutes Good Faith Conduct under this policy.

This commitment applies only to ViTrox and does not restrict any rights or obligations of customers, suppliers, system owners, regulators, law enforcement authorities or other third parties.

This policy applies to ViTrox's VisionXpert products with digital elements, including firmware, embedded software, and web-based management interfaces, unless otherwise stated by ViTrox.

Reporting Security Vulnerabilities

To report a suspected security vulnerability, please use the web form provided on this page. Please include sufficient information to help ViTrox assess the report, including the affected product, model, firmware or software version, description of the suspected vulnerability and relevant supporting information.

What to Expect

ViTrox aims to acknowledge submitted reports within 5 business days and may contact the reporter for further information to support assessment and validation.

Where ViTrox determines that remediation, mitigation, a customer notice, a security advisory or other action is appropriate, ViTrox will determine the appropriate action, timing and communication approach based on product applicability, severity, exploitability, customer impact, affected product version, available mitigations and applicable legal or regulatory requirements. ViTrox may update the reporter on progress where appropriate.

Disclosure Policy

We follow a coordinated vulnerability disclosure approach. Reporters must not publicly disclose a suspected vulnerability before ViTrox has had a reasonable opportunity to assess and address it. Where a vulnerability is confirmed, ViTrox may coordinate with the reporter on the timing and content of any security advisory, customer notice or other communication. Published security advisories, where available, are available at Security Advisories.

Public-Facing Limitation

This vulnerability disclosure channel does not create any warranty, service-level commitment, support obligation, compensation entitlement, bug bounty or other contractual commitment by ViTrox.

The protections described under this policy apply only to Good Faith Conduct. ViTrox reserves all rights in relation to conduct that does not meet the requirements for Good Faith Conduct, subject to applicable law.

Report a suspected vulnerability via the form below. For follow-up or questions about a submitted report, contact psirt_team@vitrox.com.

ViTrox’s Security Bulletins