Security

We take the security of our software seriously. If you have found a vulnerability, please tell us, so that we can fix it and protect our users. This policy explains how to report it and what you can expect from us.

Scope

This policy covers:

• all software of LabCognition, Analytical Software GmbH & Co. KG, under any brand name, including software our partners provide under their own brand ("powered by LabCognition"),
• the License Leasing Server,
• our licensing server and portal at licensing.labcognition.com,
• our website at www.labcognition.com.

It does not cover software of other companies that integrates our modules. Please report vulnerabilities in such software to that company. If you believe the cause lies in one of our modules, you are welcome to report it to us as well.

Vulnerabilities in third-party components we use are in scope. We coordinate the fix with the maintainers of the component.

How to report

Send your report by e-mail to security@labcognition.com, in English or German.

Please include:

• the affected product, brand and version,
• a description of the vulnerability and its possible impact,
• the steps to reproduce it, and a proof of concept if available,
• how we can reach you, and whether you want to be credited.

Please do not send reports through our general support channels or social media, and do not include personal data of others.

What we commit to

We keep you informed of our progress and tell you when a fix is available. If we need longer, we explain why.

We provide security updates free of charge for the whole support period stated in our license terms: 10 years for software with instrument control and 5 years for software without.

Coordinated disclosure

Please give us the chance to fix the vulnerability before you disclose it publicly. We ask you to wait until a fix is available, or for 90 days after your report, whichever comes first. We agree the date of publication with you. If the vulnerability is actively exploited, we may publish a warning earlier.

When the fix is released, we publish a security advisory and inform registered users. With your consent, we credit you in the advisory.

Under the EU Cyber Resilience Act, we report actively exploited vulnerabilities to the competent CSIRT and to ENISA. You can also report vulnerabilities to a CSIRT yourself; in Germany, this is the Federal Office for Information Security (BSI).

Guidelines for security research

We will not take legal action or file a criminal complaint against you if you research in good faith and follow these guidelines:

• Test only on installations and licenses you own or are authorized to use.
• Do not access, change or delete data of others, beyond the minimum needed to demonstrate the vulnerability.
• Do not disrupt our services or those of our customers, for example by denial-of-service attacks, spam or load tests against our servers.
• Do not use social engineering, phishing or physical attacks.
• Do not bypass or share license keys, and do not use a vulnerability to obtain licenses.
• Report the vulnerability to us without undue delay, and keep it confidential until it is fixed or the period above has passed.

If you are unsure whether an action is covered, ask us first at security@labcognition.com.

We do not run a bug bounty program and do not pay for reports.

Your data

We process your contact details and your report to handle the vulnerability. Details are in our privacy policy, section "Software Licensing, Activation and Support".