Security

Vaadin is committed to resolving vulnerabilities to meet the needs of its customers and the broader technology community. This page describes Vaadin's policy for receiving reports related to potential security vulnerabilities in its products and services and the company’s standard practice with regards to informing customers of verified vulnerabilities.

When to contact the security emergency response team

Contact the Vaadin Product Security Incident Response Team (PSIRT) by sending email to security@vaadin.com in the following situations:

• You have identified a potential security vulnerability with one of our products;
• You have identified a potential security vulnerability with one of our services.

To ensure confidentiality, we encourage you to encrypt any sensitive information you send to us via email. We are equipped to receive messages encrypted using S/MIME. You can download a copy of the certificate that can be used to send encrypted email to us: security_vaadin_com.p7b.

The security@vaadin.com email address is intended ONLY for the purposes of reporting product or service security vulnerabilities. It is not for technical support information on our products or services. All content other than that specific to security vulnerabilities in our products or services will be dropped. For technical and customer support inquiries, please use Stack Overflow or create an issue in the corresponding GitHub repository.

Vaadin PSIRT will confirm receipt of your report within three business days. We will work with internal teams to verify the finding and respond in a timely manner with an update or request for additional information.

Receiving security information from Vaadin

Technical security information about our products and services is distributed through several channels.

• Vaadin distributes information to customers about security vulnerabilities via the vaadin.com/security page, GitHub security advisories (where applicable) and by email to registered users. In most cases, we will issue a notice when we have identified a practical workaround or fix for the particular security vulnerability though there can be instances when we issue a notice in the absence of a workaround when the vulnerability has become widely known to the security community.

  As each security vulnerability case is different, we can take alternative actions in connection with issuing security notices. Vaadin can determine to accelerate or delay the release of a notice or not issue a notice at all. Vaadin does not guarantee that security notices will be issued for any or all security issues customers can consider significant or that notices will be issued on any specific timetable.

• Security-related information can also be distributed by Vaadin to public newsgroups or electronic mailing lists. This is done on a case-by-case basis, depending on how Vaadin perceives the relevance of each notice to each particular forum.

• Vaadin works with the formal incident response community to distribute information. Many company security notices are distributed by regional CSIRT at the same time that they are sent through company information distribution channels.

All aspects of this process are subject to change without notice, as well as to case-by-case exceptions. No particular level of response is guaranteed for any specific issue or class of issues.

Vulnerability reports