Security at JADAPTIVE

Reporting a Security Vulnerability

If you believe you have identified a security vulnerability in a JADAPTIVE product, we encourage you to report it privately so that we can investigate and coordinate an appropriate response.

Please provide sufficient information to help us understand and reproduce the issue, including:

• The affected product and version.
• A description of the suspected vulnerability.
• The conditions required to reproduce the behaviour.
• The potential security impact.
• Relevant logs, test cases or supporting evidence, where available.

Please avoid including passwords, private keys, production credentials or other sensitive information unless a secure method of exchange has been agreed.

Our Vulnerability Handling Process

1. Report and Initial Assessment

We review reported security issues to establish the affected products, technical circumstances and potential impact. Where necessary, we may request additional information to assist with reproduction and investigation.

2. Investigation and Verification

Our engineering team investigates the reported behaviour, examines the relevant implementation and determines whether a security vulnerability exists.

Because many JADAPTIVE products are software development libraries integrated into customer applications, the practical impact of a vulnerability can depend on the configuration, authentication model and security controls implemented by the integrating application.

3. Remediation and Testing

Confirmed vulnerabilities are assessed for appropriate remediation in maintained product releases.

Corrections undergo engineering review and regression testing, with particular attention to ensuring that the reported security boundary is enforced and that the change does not introduce unintended behaviour.

4. Customer Notification

Where appropriate, JADAPTIVE issues security advisories describing the vulnerability, affected products, available fixes and recommended customer actions.

We may notify affected customers directly to support timely assessment and remediation.

5. Public Disclosure

JADAPTIVE publishes public security advisories to provide a durable reference for confirmed vulnerabilities and their remediation.

Public advisories may include technical descriptions, affected and fixed versions, remediation guidance and CVE identifiers where assigned.

The timing and level of technical detail may vary according to the vulnerability, availability of fixes and relevant disclosure considerations.

Coordinated Disclosure

We encourage security researchers and customers to give JADAPTIVE an opportunity to investigate and address suspected vulnerabilities before publicly disclosing technical details that could facilitate exploitation.

We recognise the importance of responsible security research and aim to work constructively with those who report vulnerabilities in good faith.

Please restrict testing to systems and environments you own or are explicitly authorised to assess. Do not access, modify or disclose third-party information, disrupt production services or conduct destructive testing.

Security Updates and Supported Versions

Security corrections are generally delivered through maintained product releases and supported maintenance branches.

Customers should review the affected and fixed versions identified in each advisory and upgrade to an appropriate corrected release.

Support for historical versions, including custom backports, is not automatically included in standard maintenance. Customers with specific version constraints should contact JADAPTIVE Support to discuss available options.

Security Advisories

Our public security advisories document confirmed vulnerabilities, their potential impact and available remediation.