For security reports regarding BARONESS products and related software.
Use the dedicated contact below to report suspected product vulnerabilities, software or firmware security issues, insecure update behavior, authentication or access control issues, or other cybersecurity concerns that may affect BARONESS products.
01.
Product Security Policy
KYOEISHA CO., LTD. develops and maintains BARONESS products with attention to product safety, quality and cybersecurity. For products with digital elements, we aim to reduce cybersecurity risk throughout the product lifecycle by applying risk-based security activities in design, development, production, delivery, support and maintenance.
Security principles
- Consider cybersecurity risks based on intended and reasonably foreseeable use.
- Protect confidentiality, integrity, availability and product safety where applicable.
- Manage vulnerabilities and security updates during the applicable support period.
- Maintain evidence needed to demonstrate product and process conformity.
Lifecycle activities
- Security risk assessment and secure design review.
- Management of external components and SBOM-related information.
- Security testing, review and release assessment.
- Vulnerability handling, user notification and continuous improvement.
02.
Vulnerability Disclosure Policy
We ask security researchers, customers, distributors and other parties to report potential product vulnerabilities to BARONESS using the dedicated email address. We will review submitted information, request additional details when necessary and coordinate remediation and disclosure as appropriate.
What to include in your report
| Product identification | Product name, model, serial number, software or firmware version and related accessories or connected services, if known. |
|---|---|
| Issue summary | A clear description of the suspected vulnerability, affected function, interface or component and the potential security impact. |
| Reproduction information | Steps to reproduce, proof-of-concept information, logs, screenshots or packet captures, with sensitive information removed where possible. |
| Reporter information | Your name or organization, preferred contact method, preferred disclosure timing and whether you request acknowledgement in an advisory. |
Coordinated disclosure process
- ReceiptBARONESS receives the report through the dedicated product security email address.
- TriageWe review the report, confirm whether it may affect a BARONESS product and may request additional information.
- AssessmentWe assess severity, exploitability, affected products or versions and whether users or authorities need to be notified.
- RemediationWhere appropriate, we prepare mitigation, update, configuration guidance, user notification or other corrective action.
- DisclosureWhen disclosure is appropriate, we publish or update a security advisory and coordinate timing with relevant parties.
Researcher expectations
Please do
- Act in good faith and avoid harm to users, products, services or data.
- Use only the minimum testing needed to demonstrate the issue.
- Keep vulnerability details confidential until coordinated disclosure timing is agreed.
- Comply with applicable laws and regulations.
Please do not
- Access, modify, delete or exfiltrate data that is not your own.
- Disrupt products, services, networks, safety functions or availability.
- Use social engineering, phishing, physical attack or destructive testing.
- Publicly disclose details before remediation or coordination is completed.
03.
Security Advisories
Security advisories will be posted here when BARONESS determines that users, distributors or other stakeholders should be informed of a product security issue, mitigation, corrective action or security update.
| Date | Advisory ID | Product | Severity | Status |
|---|---|---|---|---|
| -- | BPSA-YYYY-NNN | -- | -- | No published advisory |
Advisory content may include affected products and versions, vulnerability description, potential impact, severity, mitigation or update instructions, acknowledgement and revision history.