Report a Vulnerability
We welcome security researchers, customers, partners and suppliers to report potential vulnerabilities affecting our products. Our Product Security Incident Response Team (PSIRT) receives, handles and discloses these reports.
Machine-readable security contact information is available in our security.txt file (RFC 9116).
PGP key status: YTL’s OpenPGP public key is published. Download the public key (.asc) and verify fingerprint 574B 4FE6 B6E9 FAD9 ACAF 9B6E C6B4 F84A 6B30 B5B7 before use. Do not send passwords, private keys, customer data or sensitive exploit material in an unencrypted email.
How We Handle Vulnerability Reports
Our handling process follows the principles of ISO/IEC 29147 and ISO/IEC 30111:
Register the report and assign a tracking ID.
Verify the vulnerability and score severity using CVSS.
Develop a fix or mitigation and confirm the affected scope.
Review and publish the security advisory.
Continuously improve product security and our process.
Response Times
We handle external reports against the following target timeframes. Actual timing may vary with complexity.
| Stage | Target time |
|---|---|
| Acknowledgment of receipt | within 3 business days |
| Initial assessment | within 10 business days |
| Status update while open | at least every 30 days, or sooner on material progress |
| Fix release notice | upon release of the security update |
Coordinated Disclosure
We follow coordinated vulnerability disclosure. As a general target, once a fix or effective mitigation is available, we aim to publish a public advisory within 90 days, subject to severity and coordination complexity.
We disclose vulnerability and remediation information through three forms:
- Security advisory — severity, affected products and versions, impact and remediation, typically for serious and high-severity vulnerabilities.
- Security statement — topic summary and latest progress, for security topics of broad interest.
- Release notes — vulnerabilities fixed in a release, to inform customers of a product’s security status.
Product Security & Support
Security Support Period
For products with digital elements placed on the EU market, we target a security support period of at least 5 years from the date of placing on the market, during which security updates are made available, as a rule, free of charge.
Model-specific: The exact support period and end-of-support date vary by product model and configuration. Always refer to the model-specific product documentation.
Software Bill of Materials (SBOM)
YTL establishes and maintains a software bill of materials (SBOM) for applicable products and their supported versions. Regulatory authorities, conformity assessment bodies, qualifying customers, vulnerability coordination organisations and other authorised parties may request the SBOM for legitimate purposes. After verifying the applicant’s identity, intended use and confidentiality requirements, YTL provides the information in a controlled manner through an agreed secure channel.
The SBOM is produced in a structured, machine-readable format conforming to recognised specifications such as SPDX or CycloneDX, and is provided as JSON or XML, as applicable.
Secure-by-Design
In line with the CRA essential requirements (Annex I), YTL is progressively applying secure-by-design and secure-by-default principles, including limited attack surface, protection against unauthorised access, and support for security updates. The precise controls depend on the product and are documented per model.
Security Advisories
Advisories are published after a vulnerability is remediated. Each advisory records the advisory ID (e.g. YTL-SA-2026-001), CVE identifier where assigned, affected products and versions, severity, remediation, and publication date.
No advisories published yet. YTL is establishing its coordinated disclosure process. When an advisory is released, it will appear on this page.
Glossary
| Term | Definition |
|---|---|
| PGP | Pretty Good Privacy — an encryption program for securing communications. |
| CVSS | Common Vulnerability Scoring System — a standard for rating vulnerability severity. |
| CVE | Common Vulnerabilities and Exposures — a public list of known security vulnerabilities. |
| SBOM | Software Bill of Materials — a machine-readable inventory of software components. |
| CRA | Cyber Resilience Act — Regulation (EU) 2024/2847. |
| PSIRT | Product Security Incident Response Team — the team that receives, handles and discloses product vulnerabilities. |
