Vulnerability Disclosure Policy
Responsible Vulnerability Disclosure
1. Introduction
The security of M‑Pix products, software and integrated solutions is a fundamental part of our commitment to customers, partners and end users.
M‑Pix welcomes reports from customers, security researchers, technology partners and other stakeholders who identify potential security vulnerabilities affecting our products or services.
The purpose of this policy is to provide a clear, transparent and collaborative process for the reporting, assessment and handling of security vulnerabilities.
2. Scope
This policy applies to products and solutions marketed by M‑Pix, including:
- software developed by M‑Pix;
- embedded firmware;
- electronic boards and controllers;
- OEM products and subsystems;
- communication interfaces and applications;
- remote or digital services operated by M‑Pix, where applicable.
Products and components developed by third parties remain subject to the security policies of their respective manufacturers. However, M‑Pix will cooperate with the relevant suppliers whenever a vulnerability may affect M‑Pix products or customers.
3. Reporting a Vulnerability
Security vulnerability reports should be submitted to:
To support an effective evaluation, please provide whenever possible:
- affected product name;
- product or software version;
- detailed description of the vulnerability;
- estimated impact;
- reproduction steps;
- logs, screenshots or technical evidence;
- contact information for follow‑up communication.
Reports may be submitted in English or Italian.
4. M‑Pix Commitment
Upon receiving a vulnerability report, M‑Pix will:
- acknowledge receipt of the report;
- perform an initial assessment;
- validate and classify the issue;
- evaluate its impact on affected products;
- define and implement appropriate corrective or mitigating actions;
- inform affected parties where necessary;
- comply with applicable legal and regulatory obligations.
5. Coordinated Vulnerability Disclosure
M‑Pix supports the principles of Coordinated Vulnerability Disclosure (CVD).
We ask researchers to:
- act in good faith;
- avoid disrupting systems or services;
- avoid unauthorized access to customer or third‑party data;
- refrain from public disclosure before the issue has been assessed and, where possible, remediated;
- provide M‑Pix with a reasonable period of time to investigate and address the issue.
M‑Pix is committed to working professionally and transparently with reporters throughout the process.
6. Vulnerability Handling and Security Updates
When a vulnerability is confirmed, M‑Pix will determine the most appropriate remediation actions, which may include:
- software or firmware updates;
- configuration changes;
- temporary mitigation measures;
- security notifications to affected customers.
Response priority and remediation timelines will depend on the severity of the issue, associated risks and impact on affected products.
7. Information for OEM Customers and Partners
M‑Pix operates both as a supplier of complete solutions and as a supplier of components, subsystems and technologies integrated into third‑party equipment.
Within OEM and partner relationships, and subject to applicable confidentiality obligations, M‑Pix may provide:
- relevant vulnerability information;
- security advisories;
- product support lifecycle information;
- software component information;
- documentation supporting customers' regulatory compliance obligations.
8. Protection of Reporters
M‑Pix values the contribution of the cybersecurity community and is committed to handling good‑faith vulnerability reports responsibly and confidentially.
Information provided by reporters will be used solely for the assessment and remediation of the reported vulnerability and for improving the security of M‑Pix products and services.
9. Security Contact
For product security matters or vulnerability reporting: