This policy constitutes the coordinated vulnerability disclosure policy implemented by Skaleet, in its capacity as a manufacturer of products with digital elements, in application of Regulation (EU) 2024/2847 (Cyber Resilience Act).

At Skaleet, the security of our information and communication systems is an absolute priority.

However, the existence of vulnerabilities can never be entirely ruled out, despite all efforts deployed. When vulnerabilities are detected and exploited, they jeopardise the confidentiality, integrity or availability of Skaleet's systems and the information processed therein.

This vulnerability disclosure policy describes the systems and types of tests that are authorised, and the procedures for reporting vulnerabilities. We encourage you to contact us at security@skaleet.com to report any potential security issues in our systems in accordance with this policy.

The company undertakes not to initiate legal proceedings (including for unauthorised access to automated data processing systems or infringement of intellectual property) against individuals reporting a vulnerability, if and only if the conditions and process described in this policy are fully adhered to.

In order to benefit from this protection, the reporter must unconditionally fulfil all of the following conditions:

• Reporting and compliance with the process: Report the discovered vulnerability through our official and exclusive communication channel, and maintain strict confidentiality.

• No destruction or alteration: Guarantee that the vulnerability discovery process has resulted in no destruction, alteration, modification or deletion of data, systems, infrastructures or services belonging to the company or its clients.

• Preservation of operations: Refrain from any action liable to interrupt, slow down or degrade the availability of our services or the activity of our users.

Any breach of any of these conditions, and in particular any destruction or compromise of data in the course of research, shall result in the immediate cancellation of this non-prosecution undertaking. The company shall then reserve the right to initiate all appropriate legal, civil and criminal proceedings.

Skaleet reserves the right to modify its coordinated vulnerability disclosure policy at any time, without prior notice, and to grant exceptions to its rules on a case-by-case basis.

By submitting your contact details and report, you confirm that you have read and unreservedly accept the terms of Skaleet's coordinated vulnerability disclosure policy.

The personal data transmitted on this occasion (including your identity and email address) are processed by Skaleet solely for the purpose of handling the report. For any information on this processing, you may consult Skaleet's privacy policy.

This policy applies to all company systems connected to the internet.
Vulnerabilities identified in systems by their manufacturers are also excluded from the scope and must be reported directly to those manufacturers in accordance with their own disclosure policy (where applicable).

• Introducing malicious software (viruses, worms, Trojans, etc.) into a system;

• Compromising a system by using exploits to gain full or partial control of it;

• Copying, modifying or deleting data from the system;

• Making modifications to the system;

• Repeatedly accessing the system or sharing access with third parties;

• Using any access obtained to attempt to access other systems;

• Modifying the access rights of other users;

• Using automated scanning tools;

• Attempting to access a system through brute-force attacks;

• Using denial-of-service attacks or social engineering techniques (phishing (voice), spam, etc.);

• Carrying out attacks affecting physical security.

In order to enable us to effectively analyse and remediate any reported vulnerability, we expect each reporter to provide us with a report that is as complete and detailed as possible. An insufficiently documented report prolongs the processing time and may compromise our ability to reproduce and address the identified issue.

Any vulnerability report sent to security@skaleet.com must include the following elements:

• Description of the vulnerability: A clear and precise explanation of the nature of the identified issue, the affected component or system, and the conditions under which the vulnerability may be exploited.

• Step-by-step reproduction procedure: A detailed and ordered sequence of steps enabling our teams to reproduce the vulnerable behaviour independently, from a neutral environment.

• Supporting evidence: All supporting material useful for understanding the report, such as screenshots, video recordings, raw HTTP requests, code excerpts or any other relevant technical artefact. These elements must be embedded directly in the body of the message, as attachments may contain malicious software.

• Potential impact: A description of the consequences that exploitation of the vulnerability could entail, particularly in terms of impact on the confidentiality, integrity or availability of Skaleet's data and systems or those of its clients.

• Technical environment: Any contextual information likely to facilitate reproduction, such as the browser or client used, the operating system version, the URL or entry point concerned, or the account used at the time of discovery (if applicable, omitting any sensitive data).

Skaleet acknowledges receipt of any report within 5 business days and informs the reporter, within an additional 5 business days, of the qualification retained and, where applicable, of the intended remediation timeline. The reporter shall refrain from any disclosure to a third party or to the public of the existence of the report and its content, unless otherwise agreed between the parties.