Vulnerability Disclosure PolicyVulnerability disclosure policy

We recognize information security as an important responsibility and work to improve the security of the services we provide.
If you discover a vulnerability in our systems or services, report it in accordance with the following policy.

Scope

This policy covers the following services and websites that we operate and manage.

• https://amnimo.com/

Disclosure

We publish information about how we handle vulnerabilities in our products on our Announcements page.

Where to report

Report vulnerabilities using the following request form.

• Request form (Japanese)

*Under [Inquiry type], select “Vulnerability report“.
*Include as much of the required information as possible.

What to include in your report

1. Information that identifies the product or service
   • Product name, model number, and firmware version
   • Serial number
   • Name of the service or function concerned
2. Details of the vulnerability
   • Type and summary of the vulnerability
   • Behavior observed and scope of impact
   • Steps to reproduce (in as much detail as possible)
   • Settings and preconditions used
3. Additional technical information
   • Proof-of-concept (PoC) code or log files (optional)
   • Screenshots or videos (optional)
   • Related network configuration and environment information

Personal information protection policy

We manage the information you provide in accordance with our privacy policy.
For details, see the following page.

• amnimo personal information protection policy (Japanese)

What happens after you report

1. Acknowledgment
   After reviewing your report, we will acknowledge receipt, as a rule within five business days.
   Acknowledgment may be delayed by our company holidays or other circumstances.
2. Review and investigation
   The responsible department examines the report and investigates whether the vulnerability can be reproduced and what it affects.
3. Decision on how to respond
   We carry out fixes or further investigation as needed.
4. Fix and re-verification
   If the vulnerability is confirmed, we fix it and verify the fix.
5. Completion report
   When we have finished, we inform the person who reported the vulnerability of the result.

How we keep you informed

• We will update you when there is significant progress or when the response takes time.
• If anything in your report is unclear, we may contact you to confirm it.
• When we have finished, we will email you a summary of what we did and the result.

Requests to reporters

• Vulnerability reports under this policy are assumed to be made in good faith.
• Accessing, obtaining, or altering data by exploiting a vulnerability may violate the law.
• Do not infringe the rights of others or interfere with the operation of our services.
• Do not publish your report or the status of our response without our consent.
• As a rule, we do not offer rewards (such as bug bounties) for reports.

Disclaimer

This policy may change without notice. For details, see the following document.

• General Terms and Conditions for Quotations and Contracts for amnimo Hardware Products and Related Software Products (PDF) (Japanese)