Vulnerability Disclosure Policy

Particle Measuring Systems is committed to providing secure products, software and services. This policy covers security research involving Particle Measuring Systems products with digital elements, including specific firmware, software, and related services listed in the Scope section.  As part of this commitment, we maintain a robust security program to identify and mitigate potential vulnerabilities in our products within our product lifecycle support periods.   We will work with security researchers around the world who wish to help identify potential vulnerabilities in our firmware and software that were not already detected through our internal controls, thereby enabling us to address those appropriately. 

 Our Vulnerability Disclosure Program (VDP) is a structured framework for security researchers to identify and submit security vulnerabilities to us. This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities. 

 

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Particle Measuring Systems will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known. 

 

Under this policy, “research” means activities in which you: 

• Notify us as soon as possible after you discover a real or potential security issue. 

• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data. 

• Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems. 

• Provide us at least 90 calendar days before public disclosure, unless we agree to a different coordinated disclosure timeline as some vulnerabilities may require longer remediation timelines. 

• Do not submit a high volume of low-quality reports. 

 Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us promptly and securely, and not disclose this data to anyone else. It is imperative that a solution be identified, and a coordinated disclosure be developed to minimize impact. 

 The following test methods are not authorized: 

• Network denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data 

• Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing 

 This policy applies to all products with digital elements produced or distributed by Particle Measuring Systems, including firmware, software, and services.  Any product that is not in scope are not authorized for testing. 

 Any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing. Additionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us at psec@pmeasuring.com. 

 Though we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We may increase the scope of this policy over time.

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely Particle Measuring Systems, we may share your report with the appropriate agencies where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission.  We will handle submitted reports and related personal data in accordance with applicable confidentiality, privacy, and data-protection requirements 

 We ask you to only share details about the vulnerability you found or the affected products through secure channels that guarantee the confidentiality and the integrity of the conversations.  

 We strongly recommend encrypting your report using our PGP key. If you are unfamiliar or uncomfortable with PGP, send us a normal email without any info on the vulnerability you discovered so we can agree on an appropriate secure channel. 

Do NOT send us information about active vulnerabilities that may affect our products through regular email. 

 

Particle Measuring Systems PSEC <psec@pmeasuring.com>
 PGP Fingerprint:
5D73 8FED 992E 797C 084C 7349 24DA 3E8D 7B39 8EAD 

 Public Key: 

 —–BEGIN PGP PUBLIC KEY BLOCK—– 

mDMEalAK+hYJKwYBBAHaRw8BAQdAgsggb4MMXNQmRBoalNmYXkoMLoixJPN+M5gU 

amUJgBi0NVBhcnRpY2xlIE1lYXN1cmluZyBTeXN0ZW1zIFBTRUMgPHBzZWNAcG1l 

YXN1cmluZy5jb20+iLUEExYKAF0WIQRdc4/tmS55fAhMc0kk2j6NezmOrQUCalAK 

+hsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDECGwMFCQWkwqYFCwkIBwICIgIG 

FQoJCAsCBBYCAwECHgcCF4AACgkQJNo+jXs5jq0NjQD/Y/rf1HG3GC19TDX0D2RP 

BNvR48klLO5On8kHwQt/rCoBANTq42c5Yp4iBcp7DPeNU63769B7uomTYesf3/nB 

rr8AuDgEalAK+hIKKwYBBAGXVQEFAQEHQBpQuJp9p16d1wvcNocN8JK/iSNdLj+r 

Gmmcd+zieIQdAwEIB4iaBBgWCgBCFiEEXXOP7ZkueXwITHNJJNo+jXs5jq0FAmpQ 

CvobFIAAAAAABAAObWFudTIsMi41KzEuMTIsMiwxAhsMBQkFpMKmAAoJECTaPo17 

OY6toz0BAL/TXF4X48WmAHhxt7VJMBb6zGUBLdZtjV/yqG4xlGEQAP99e0wheJ8c 

O1UD77jmKzwV4M8aPSpjAqDAJitNecGdCg== 

=iGaz 

—–END PGP PUBLIC KEY BLOCK—– 

Using PGP encryption helps ensure your communication remains confidential and protected during transmission. 

 If you share contact information, we will acknowledge receipt of your report within 5 business days. 

 What we would like to see from you 

 To help us triage and prioritize submissions, we recommend that your reports: 

• Product name and version 

• Description of the vulnerability 

• Steps to reproduce the issue 

• Potential impact 

• Any proof-of-concept or supporting materials 

 What you can expect from us 

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible. 

• We will acknowledge receipt of your report within 5 business days 

• We will investigate and validate all reports promptly 

• We will work to remediate confirmed vulnerabilities in a timely manner 

• We may contact you for additional information during our investigation 

• We may, with your express consent, publicly recognize you or your organization for a valid vulnerability report after remediation or coordinated disclosure, subject to applicable law. Public recognition is optional and we may decline, delay, or modify public recognition where necessary for safety, legal, regulatory, confidentiality, sanctions, export-control, third-party, or operational reasons 

Reports may be submitted anonymously. If you do not provide contact information, we may be unable to acknowledge receipt, request clarification, coordinate remediation, or provide recognition, but we will review reports containing sufficient technical detail. 

 Public recognition, if provided, is not compensation and does not create any entitlement to payment, employment, vendor status, or other benefit. 

 What we don’t want to see 

 Please don’t use the contact methods outlined above for anything that isn’t product security related.   Communication that falls outside of scope will be deleted and will not receive a response.  For non-product security related enquiries, please use the contact methods elsewhere on this website. 

Particle Measuring Systems may modify the terms of this policy or terminate the policy at any time

Particle Measuring Systems does not authorize, permit, or otherwise allow (expressly or implied) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity, to engage in any security research or vulnerability or threat disclosure activity on or affecting Particle Measuring Systems products that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or other applicable law, you may be subject to criminal and/or civil liabilities. 

Questions regarding this policy may be sent to the email addresses previously detailed. We also invite you to contact us with suggestions for improving this policy.