Product Security Incident Response Team
(PSIRT)
Security does not end when a product leaves our factory. If you discover a vulnerability in one of our products, we want to hear about it, before someone else takes advantage of it.
Our Product Security Incident Response Team receives reports on security vulnerabilities in the MX product family, the AZ product family, and our operating and visualization software. We review every report, keep you informed as we work on it, and agree on a disclosure timeline together with you.
PGP Fingerprint
1D5F 742D 861D 1F0F E092 3A7D 6FFC 84D1 027E E0FF
Coordinated Vulnerability Disclosure Policy
This page summarizes our policy. The full document is the authoritative version and is the one to cite or archive.
How this works
What this policy covers
This policy applies to all E+H Metrology products:
- MX product family, handheld measurement devices and automated sorting systems
- AZ product family, analog measurement systems
- Operating software and visualization software
Third-party products, corporate IT, and our website are out of scope unless the issue affects product security. Found something outside this scope? Contact us anyway and we will route it internally.
What to include
The more of this you can give us, the faster we can act (Reports in German and English are both welcome):
- Affected product and version
- What the vulnerability is and what it allows
- Steps to reproduce
- Proof of concept, screenshots, or logs, kept minimal
- How to reach you, plus your PGP key if you have one
What you can expect
- Within 3 business days, we confirm your report has reached us
- Within 10 business days, we send an initial assessment of validity and severity
- Within 90 days as a rule, we aim to have a fix and agree disclosure with you