🛡️ MCL Vulnerability Disclosure Program
At MCL, the security of our software and customers is our top priority. Despite our rigorous
quality assurance, vulnerabilities can sometimes slip through. If you have discovered a security
flaw in any MCL software or source code, we want to work with you to fix it.
Thank you for helping us keep our systems safe.
📬 How to Report a Vulnerability
Please do not share security vulnerabilities publicly. Report all findings directly to the MCL Cyber Security Incident Response Team.
- Email: security@mcl-technologies.com
- Language: English preferred
📋 What to Include in Your Report
To help us triage and resolve the issue quickly, please provide as much detail as possible:
- Issue Type: (e.g., SQL injection, XSS, buffer overflow)
- Affected Paths: Full paths of the source files involved
- Code Location: Specific tag, branch, commit hash, or direct URL
- Configuration: Any special environment settings required
- Reproduction Steps: Clear, step-by-step instructions
- Impact: How an attacker could exploit this vulnerability
🚦 Rules of Engagement
We ask that you follow these guidelines to ensure a responsible disclosure process:
- Keep it Private: Do not disclose the vulnerability to the public or third parties until we have successfully patched it.
- Minimize Data: Do not copy, alter, or download more data than strictly necessary to demonstrate the flaw.
- Delete Exfiltrated Data: Permanently erase all obtained data immediately after submitting your report.
- Protect Performance: Avoid any actions that degrade system availability, performance, or integrity.
🚫 Strictly Prohibited Actions
- Installing malware, viruses, worms, or Trojans
- Executing automated scanning or brute-force tools
- Launching Denial of Service (DoS/DDoS) attacks
- Using social engineering (phishing, vishing, spam) or physical attacks
🛑 Out of Scope Issues
The following common findings are not eligible for review unless they directly lead to a critical exploit (such as account takeover):
- Missing HTTP security headers
- Cookies missing HttpOnly or Secure flags
- Software version disclosure / banner identification
- Missing SSL/TLS configuration best practices
- Email configuration flaws (missing SPF, DKIM, DMARC, MTA-STS)
- Missing rate limits (without a direct path to account takeover)
⏱️ Our Commitment to You
- Fast Response: We will acknowledge receipt of your report as soon as possible.
- Regular Updates: We will keep you informed of our progress. If you haven't heard from us, feel free to follow up via email.
- Recognition: We appreciate your efforts and will make every effort to acknowledge your contributions responsibly.
📖 Publication & Terms
- Public Write-ups: If you wish to publish your findings after a patch is deployed, you must notify us 1 month prior to publication.
- MCL Branding: You may only mention MCL in a public post with our explicit written approval.
- Questions? If you are unsure if a test is permitted, email us at security@mcl-technologies.com for permission first.
MCL reserves the right to modify or terminate this policy at any time.