Xirgo Coordinated Vulnerability Disclosure Policy

Oct 1, 2026

Our commitment and scope

Xirgo welcomes reports of security vulnerabilities in our products and services from anyone. You do not need a commercial relationship with us. This policy applies on the same terms in every market where we supply products or services.

In scope:

Xirgo devices, including their firmware, bootloaders and over-the-air update packages
Xirgo cloud platforms, portals and APIs
Xirgo public websites

Out of scope:

Products, services or infrastructure that Xirgo does not own or operate
Social engineering, phishing and physical attacks
Denial-of-service attacks
Products that have passed the end of their published security support period
Issues already known to us or already reported

How to report a vulnerability

Email ITsecurity@xirgo.com. We monitor this mailbox every business day. Our contact details are also published at xirgo.com/.well-known/security.txt.

Reporting is free. To help us triage quickly, please include as much of the following as you can:

The affected product, version, or URL
A description of the vulnerability and its potential impact
Steps to reproduce it, including any tools used
Supporting evidence, such as screenshots, network captures or proof-of-concept code
A suggested severity or CVSS score (optional)
How we can contact you for follow-up

You may report anonymously. If you do, we may not be able to send you updates or credit you.

What happens after you report

Stage	Our commitment
Acknowledgement	We confirm receipt within 3 business days
Triage	We tell you our triage outcome within 10 business days
Remediation	We fix or mitigate confirmed vulnerabilities in order of severity
Updates	We keep you informed until the issue is resolved

During triage, we try to reproduce the issue, assess its severity using CVSS, and identify the affected products and versions. If we need more information, we will contact you.

We prioritise fixes by severity. For devices, fixes follow the patch targets in the Product Security Support & End-of-Life Statement for the market where the product is supplied. If a fix will take longer than expected, we will tell you and share any interim mitigation.

Guidelines and safe harbour

We ask that you:

Act in good faith and follow this policy
Do not access, change or delete data that is not yours, beyond what is needed to show the issue
Do not disrupt our services or our customers
Give us a reasonable chance to fix the issue before you disclose it publicly

We will not pursue legal action against anyone who carries out good-faith research within this policy. We will not ask you to sign a non-disclosure agreement before we triage your report.

We treat your report as confidential. We do not share your personal information with third parties without your consent, unless the law requires it. We use it only to investigate and resolve the issue.

Disclosure and recognition

We support coordinated public disclosure. Before anything is published, we aim to agree with you the disclosure date and the content of any advisory.

When a fix is ready, we will tell you and publish a security advisory or release note where appropriate. With your consent, we will credit you in it. We may disclose without your involvement where this is necessary to protect users or to meet a legal obligation.

We do not offer payment for reports at this time.

This policy is designed to align with the draft standard prEN 40000-1-3. We review it at least once a year and after any significant change to our products or regulatory obligations.

Coordinated Vulnerability Disclosure Policy

Help Us Keep Our Products Secure