This Coordinated Vulnerability Disclosure Policy applies to products and software developed and marketed by Domat Control System s.r.o. It does not apply to third-party systems into which our products are integrated.
Please send vulnerability reports to psirt@domat.cz.
Sensitive information should be encrypted using the PGP key published at https://domat.cz/.well-known/psirt-pgp-key.txt
We accept reports in both Czech and English.
When submitting a report, please include:
The affected product and version
A description of the vulnerability, including steps to reproduce it
An assessment of the potential impact
Proof-of-concept code, if applicable
Please do not include personal data of third parties or data originating from systems you do not own or have authorization to test.
We are committed to:
Acknowledging receipt of your report within 3 business days.
Providing the outcome of our initial assessment within 10 business days.
Keeping you informed of progress at least once every 14 days.
Coordinating public disclosure with you, typically within 90 days of validating the finding, with adjustments made based on the complexity of remediation.
We will not pursue legal action against security researchers who act in good faith and in accordance with this policy.
This safe harbor applies provided that researchers refrain from:
Accessing data beyond what is necessary to demonstrate the vulnerability.
Intentionally disrupting the availability of services or devices.
Using social engineering techniques against our employees or customers.
Gaining physical access to company or customer premises without authorization.
Demanding compensation under the threat of public disclosure.
With the researcher's consent, we will acknowledge their contribution in the relevant vulnerability advisory.
At this time, we do not offer financial rewards for vulnerability reports.
Effective Date: September 11, 2026 | Version: 1.1 | Contact: psirt@domat.cz
