Vulnerability Disclosure Policy

Last updated: 23 September 2026

RAYLAB takes the security of its products seriously. If you believe you have found a security vulnerability in one of our products, we encourage you to report it to us. This policy explains how to do so and what you can expect from us.

Scope

This policy covers RAYLAB products with digital elements, including their firmware, embedded software and companion software:

  • DIAMON
  • DIAMON-FX
  • STARLITE
  • UNCLE-SA (software)
  • RAYLAB-CS (software)

Reports concerning this website (raylab.solutions) are also welcome.

How to report a vulnerability

Send an email to security@raylab.solutions.

To help us assess the issue quickly, please include where possible:

  • the affected product and its software/firmware version (shown in the device’s web panel or in RAYLAB-CS);
  • a description of the vulnerability and its potential impact;
  • the steps needed to reproduce it (proof of concept, screenshots, logs);
  • whether you believe it is already being actively exploited;
  • how you would like to be credited, if at all.

Reports may be written in English or Italian.

Please do not include sensitive exploit details in your first message if you are concerned about confidentiality: tell us you have a finding, and we will agree a suitable way to exchange the details.

What you can expect from us

  • Acknowledgement within 5 business days of receiving your report.
  • An initial assessment of the report, and updates on significant progress until the issue is resolved.
  • Security updates for affected products, provided free of charge to our customers.
  • Credit in the published advisory, if you wish to be named.

Coordinated disclosure

We ask that you give us reasonable time to investigate and fix the issue before any public disclosure, and that you do not share details of the vulnerability with third parties in the meantime. By default we aim to coordinate public disclosure within 90 days of the initial report, or sooner once a fix is available. We may agree a different timeline with you when the complexity of the fix, or the need to update devices installed in the field, requires it.

Once a fix is available, we publish a security advisory (see Security advisories below). Advisories contain the information users need to protect themselves — affected products and versions, impact, severity and how to update — and do not disclose source code, internal design or other confidential information. Where publishing immediately would put devices still awaiting the update at greater risk, we may delay the advisory until users have had the opportunity to install it.

Where a vulnerability is being actively exploited, RAYLAB also fulfils its reporting obligations to the competent authorities under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). You may also report vulnerabilities directly to the Italian national CSIRT (CSIRT Italia, www.csirt.gov.it).

Good-faith research

If you act in good faith and within the limits of this policy, RAYLAB will not take legal action against you in relation to your research and report. To qualify, you must:

  • only test on devices or software that you own, or are explicitly authorised to test;
  • not access, modify or delete data that does not belong to you beyond what is strictly necessary to demonstrate the vulnerability;
  • not disrupt or degrade the operation of devices in use by others (for example through denial-of-service testing);
  • not use social engineering, phishing or physical attacks against RAYLAB staff, facilities or customers;
  • comply with the confidentiality and intellectual property conditions below.

Confidentiality and intellectual property

  • This policy does not grant any licence or other right to RAYLAB’s intellectual property, and does not authorise reverse engineering, decompilation or extraction of firmware or software beyond what is permitted by applicable law.
  • You must not retain, publish or distribute firmware, source code, algorithms, calibration data, documentation or any other confidential information obtained during your research, and you must securely delete it once your report has been handled.
  • Any public disclosure on your part must take place in coordination with RAYLAB, as described under Coordinated disclosure, and must be limited to what is necessary to describe the vulnerability.
  • RAYLAB alone determines the content of its security advisories, and will not disclose trade secrets or other confidential business information.
  • The protection described under Good-faith research does not apply to anyone who does not comply with these conditions.

Bug bounty

RAYLAB does not currently operate a paid bug bounty programme.

Security advisories

No security advisories have been published yet.