Cybersecurity
Labconco is committed to the security of our products, software, and IT systems. We welcome reports from security researchers, customers, partners, and anyone else who believes they have found a vulnerability.
This page describes our Coordinated Vulnerability Disclosure (CVD) policy: what it covers, how to report an issue, what we ask of researchers, and what you can expect from us. The policy supports our obligations under the EU Cyber Resilience Act (Regulation (EU) 2024/2847) and follows the principles of ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling).
Scope
This policy covers vulnerabilities in:
Labconco products with digital elements, including connected equipment, controllers, firmware, embedded software, and companion applications
Labconco IT infrastructure and online services, including labconco.com
Reports are welcome for any current Labconco product, regardless of service contract status. Third-party products, platforms, and services are outside this policy unless they are built into a Labconco product. If you are unsure whether something is in scope, or plan testing that could affect a live product or system, contact us first.
How to Report a Vulnerability
The form below and [email protected] are Labconco's single point of contact for vulnerability reports. Use whichever you prefer. No account, contract, or non-disclosure agreement is needed, and you may report anonymously, either directly or through a national CSIRT.
To help us investigate quickly, please include as much of the following as you can:
The affected product, model, and firmware or software version, or the affected system or web address
A clear description of the vulnerability and its potential impact
Steps to reproduce the issue
Supporting evidence such as screenshots, logs, or proof-of-concept code
Whether the vulnerability is already publicly known
How you would like us to contact you, if at all
Please do not include personal data, passwords, or other confidential information unless it is essential, and mask any sensitive data in screenshots or logs. If a report must include sensitive details, email us first and we will arrange a secure way to send them.
Guidelines for Security Research
When researching Labconco products or systems, we ask that you:
Act in good faith and comply with applicable laws
Test only as much as needed to confirm the vulnerability
Avoid harming Labconco customers, users, partners, or other third parties, and respect their privacy
Avoid disrupting products or systems in use by customers
Give us reasonable time to resolve the issue before sharing any details publicly
The following are not permitted:
Denial-of-service attacks or testing that degrades availability
Accessing, copying, changing, or deleting data beyond what is needed to show the issue
Installing persistent access, malware, or backdoors
Destructive tools or techniques
Social engineering, phishing, or physical attacks against Labconco employees, facilities, or customers
Our Good-Faith Commitment
Labconco considers research carried out in good faith and in line with this policy to be a responsible contribution to the security of our products and systems. We will treat your report and personal information confidentially and will not share your identity without your permission, except where required by law or regulation.
What Happens After You Report
Acknowledgment. We will acknowledge receipt of your report as promptly as practicable.
Assessment. We will review the report, attempt to reproduce the issue where appropriate, and contact you if additional information is required.
Remediation. Our teams will evaluate confirmed vulnerabilities based on severity, potential impact, and risk, and will develop appropriate corrective or mitigating measures. Where applicable, Labconco will make required regulatory notifications in accordance with applicable law.
Disclosure. Where appropriate, we will coordinate disclosure and communicate available fixes, mitigations, or other recommended actions to affected users.
Response and remediation times depend on the severity and complexity of the issue, the availability of a fix, and the risk to users.
Coordinated Disclosure
Please do not publish details of a vulnerability until we have agreed on a disclosure date together. This gives us time to protect customers before the information becomes public. We coordinate disclosure based on the severity of the vulnerability, availability of an effective fix or mitigation, exploitation risk, potential customer impact, and applicable legal requirements.
When we publish a security advisory, it will typically include:
A description of the vulnerability, with a CVE identifier and severity rating where applicable
The affected products and versions
Recommended fixes, workarounds, or mitigations
Where to get any available updates
With your permission, we are glad to credit you in the advisory.
Contact
To report a vulnerability or ask a question about this policy, use the form above or email [email protected]. We accept reports in English. For product support, orders, or other questions, please use our standard Contact Us page.
Policy version: 1.0, published November 10, 2026. Labconco may update this policy at any time; the latest version will always be posted on this page.
