dormakaba understands that vulnerabilities are discovered through various methodologies. Whether you are a customer, user of a dormakaba product or solution, or a research professional, we are committed to working through the disclosure process with you. To enable an effective coordination throughout the response process, please be transparent about your goals, any desired timelines for public disclosure, and any information that may be important as dormakaba works to address all issues associated with the disclosure.

Vulnerability reports should include enough detail for dormakaba to replicate and validate all potential vulnerabilities, assess the potential risks, and properly prioritize mitigation efforts. Whenever possible, please include the following information in your vulnerability report:

• Affected product(s) and specific version(s) (if applicable)

• Overview of how the vulnerability was discovered

• Any proof-of-concept code or processes

• Description or estimation of impact

• Time constraints (e.g., date of planned public disclosure)

• Any additional details related to the finding to help in the validation and risk assessment process

Providing the correct information can make all the difference in ensuring the proper response to all findings. If you believe some other details are essential in how dormakaba validates or responds to the associated vulnerability, please include them as well.

Please email your report and all associated information to the contact information provided below. For more information on best practices around vulnerability disclosures and reporting, please refer to the resources below or reach out to the dormakaba security team.

Time frames for type and schedule of disclosure may be affected by various factors, including, but not limited to,

• risks to customers and users resulting from the vulnerability,

• availability of effective mitigations, and

• requirements by applicable laws and regulations.

Generally, vulnerabilities will be disclosed by dormakaba once patches or remediation steps are available to affected customers. It is critical that those who rely on affected products to protect their people, facilities, or property have adequate time to apply all fixes and mitigate any risks.

If there are timelines associated with non-dormakaba public disclosures (e.g., conference dates, publications, etc.), please let us know as soon as possible so dormakaba can plan accordingly.

Ensure all testing and research efforts do not harm or disrupt production systems. This includes any activity that may expose sensitive data associated with affected systems. Please ensure that all local laws and product terms and conditions are followed and that you are aware of any consequences associated with the security research process.

If you have any concerns about the possible impact to systems, or questions about any data discovered during testing, please contact dormakaba’s security support.