Report a vulnerability

Scope

We accept vulnerability reports concerning BLT for LabVIEW, Controls Generator for LabVIEW, and software developed and delivered by STUDIO BODs to clients.

For client software, include the project or customer reference privately in your report. We will coordinate with the affected client and any relevant maintainers. Reporting an issue does not authorize testing a client’s systems or sharing their confidential information.

If the issue involves a third-party component we distribute or use, we will help coordinate with its maintainer.

What to include

We accept reports in English or French. You may report anonymously, but we can only respond if you provide a way to contact you.

Do not include passwords, access tokens, personal data, or confidential client data. If sensitive material is necessary for investigation, contact us first so we can agree on a suitable transfer method.

• The affected product or project and version.
• Your LabVIEW version, operating system, and relevant configuration.
• A description of the issue and its potential impact.
• Steps to reproduce it, with a minimal example if possible.
• Your contact details if you would like a response.

What you can expect

If you provide contact information, we will acknowledge your report within three business days.

We will investigate, discuss our findings with you, and keep you informed about progress and significant delays. Resolution time depends on the issue and, for client projects, coordination with the affected client.

For our published products, we will provide relevant security information and remediation guidance when releasing a security fix. For client software, we will communicate directly with the affected client.

We will obtain your permission before publicly crediting you.

Responsible testing

Test only installations you own or have explicit permission to test. This policy does not grant permission to test STUDIO BODs’ or clients’ live systems.

• Limit testing to what is necessary to demonstrate the issue.
• Avoid disrupting services or modifying, deleting, or accessing other people’s data.
• Do not perform denial-of-service tests, social engineering, or physical intrusion.
• Do not establish persistent access or use an issue to access other systems.
• Stop testing if you encounter sensitive information and notify us promptly.

Coordinated disclosure

Please contact us before publishing vulnerability details so we can coordinate remediation and disclosure.

For BLT for LabVIEW and Controls Generator for LabVIEW, we ask that you wait until a fix is available or 90 days after your initial report, whichever comes first. If circumstances require a different timeline, we will discuss it with you.

For client software, we will coordinate disclosure with the affected client. The 90-day request does not authorize publication of confidential client information.