All parties submitting vulnerability reports are expected to: 

1. Comply with all applicable laws and regulations. 
2. Base all reports on the latest released firmware. 
3. Use the dedicated channel (support@hypershop.com) for submitting reports. 
4. Adhere to data protection best practices and avoid actions that compromise the privacy or security of Hyper’s users, employees, agents, services, or systems. 
5. Refrain from disclosing any information about the vulnerability to third parties prior to an agreed-upon disclosure date. 

Please note that Hyper does not operate a vulnerability bounty program at this time. 

Hyper actively encourages customers, vendors, independent researchers, and security organizations to report any potential vulnerabilities to our security team. In addition to reviewing submitted reports, Hyper proactively monitors the broader security community, vulnerability repositories, and industry security websites to identify risks as early as possible. 

When a vulnerability is reported, our process includes: 

1. Awareness and Receipt: Hyper’s security team reviews all reports as soon as they are received. We aim to acknowledge receipt of your report within 15 business days. 
2. Verification: Together with our product team, we carry out a thorough preliminary analysis and validation to determine the validity, severity, and potential impact of the vulnerability. We may reach out to the reporter to request additional details, if needed. 
3. Remediation: Once a vulnerability is confirmed, Hyper develops and implements an appropriate remediation plan. Most issues are addressed within 90 days, though particularly complex cases may require extra time. We provide ongoing updates as progress is made. 
4. Notification: Hyper will issue a security advisory when one or more of the following conditions are met: 

• The vulnerability is rated CRITICAL by the Hyper security team and we have completed our response process, with effective mitigation or solutions available for customers. 
• The vulnerability has been actively exploited or is likely to increase security risk or public concern for Hyper customers. In such cases, Hyper will expedite the release of a security bulletin, which may include a full firmware patch or an emergency fix.