Security Policy

Cirrus Link Solutions takes the security of its products seriously. This document describes how to report a vulnerability to us, what happens after you report one, and what you can expect from us in return.

If you believe you have found a security vulnerability in a Cirrus Link product, please report it to us privately using the contact details below. Please do not open a public issue, forum post, or support ticket for a suspected vulnerability.

Reporting a vulnerability

Email: security@cirrus-link.com

Please include as much of the following as you can. The more of it you provide, the faster we can confirm and fix the issue:

  • The affected product and version (for example, Chariot MQTT Server 3.0.3).
  • The platform and configuration you observed it on.
  • A description of the vulnerability and the impact you believe it has.
  • Step-by-step instructions to reproduce it, including any proof-of-concept code, payloads, or configuration.
  • Whether the issue is, to your knowledge, already publicly known or being exploited.
  • How you would like to be credited, if you would like to be credited at all.

You may write to us in English. Reports may be sent in plain text; we do not currently publish a PGP key. If you need an encrypted channel before sending details, email us and we will arrange one.

What you can expect from us

Stage Target
We acknowledge your report Within 5 business days
We tell you whether we have reproduced it, and our initial severity assessment Within 10 business days
We keep you updated on remediation progress At least every 30 days until the issue is closed
We publish an advisory and, where applicable, a fix Coordinated with you — see below

We assess severity using CVSS v3.1. We will tell you the score we assigned and why, and we will listen if you disagree with it.

Coordinated disclosure

We follow coordinated vulnerability disclosure, in line with ISO/IEC 29147 (disclosure) and ISO/IEC 30111 (handling).

  • We ask that you give us a reasonable period to remediate before disclosing publicly. Our target is 90 days from the date you report the issue.
  • That window is a target, not a rule. If a fix is straightforward we will move faster. If an issue is deeply structural, affects multiple products, or requires coordination with an upstream vendor, we may ask you for more time, and we will explain why.
  • If a vulnerability is being actively exploited, we may shorten the window and publish earlier to protect users.
  • We will agree the disclosure date with you rather than imposing one, and we will not ask you to stay silent indefinitely.
  • When we publish, we issue a security advisory describing the vulnerability, its impact, the affected versions, and how to remediate. We request a CVE identifier for vulnerabilities that affect a released product.

Recognition

We do not operate a paid bug bounty program, and we cannot offer monetary rewards.

We do credit researchers. Unless you ask us not to, we will name you in the advisory for any report that leads to a fix or to a meaningful change in our products.

Safe harbor

If you make a good-faith effort to comply with this policy while researching and reporting a vulnerability, we will:

  • Consider your research authorized, and not pursue or support legal action against you for it.
  • Work with you to understand and resolve the issue quickly.
  • Recognize your contribution as described above.

To stay within this policy, please:

  • Only test against systems and installations you own or have explicit permission to test. Do not test against other customers’ deployments or against Cirrus Link production systems.
  • Avoid privacy violations, data destruction, and any degradation of service. Do not run denial-of-service or volume testing against systems you do not own.
  • Access only the minimum amount of data needed to demonstrate the vulnerability, and do not retain, share, or publish any customer data you encounter. Tell us immediately if you encounter such data.
  • Give us a reasonable time to remediate before disclosing publicly, as described above.

This safe harbor covers action by Cirrus Link. It cannot bind third parties, and it does not authorize you to act against systems operated by our customers or partners.

Scope

In scope — the current released versions of:

  • Chariot MQTT Server (server, web UI, and the bundled IoT Bridges).
  • Cirrus Link IoT Bridge for AWS SiteWise, Microsoft Azure, and Snowflake.
  • Cirrus Link MQTT modules for Ignition — MQTT Distributor, MQTT Engine, MQTT Transmission, MQTT Recorder, the cloud injector modules, and the Cirrus Link device drivers.

We generally support the latest release of the current major version, plus the preceding major version for a defined period after its successor ships. Where a product’s support period has been published, that published date governs.

Out of scope:

  • The Ignition platform itself, which is developed by Inductive Automation. Please report Ignition platform issues to Inductive Automation directly. If you are not sure which side an issue falls on, report it to us and we will route it and coordinate with them.
  • Third-party cloud services (AWS, Azure, Google Cloud, Snowflake) and third-party libraries, except where we ship a vulnerable version or use one unsafely. Report those to us and we will handle the upstream coordination.
  • Vulnerabilities in a customer’s own deployment, configuration, or network, unless they stem from an insecure default or from missing guidance on our side — in which case we do want to hear about it.
  • Findings from automated scanners with no demonstrated impact, missing best-practice HTTP headers with no exploit path, and reports that amount to a difference of opinion about configuration hardening.

Security advisories

We publish advisories for vulnerabilities affecting released products, along with the fixed versions and any mitigations available to users who cannot upgrade immediately. Subscribe to security alerts below.

Regulatory reporting

Cirrus Link products fall within the scope of the EU Cyber Resilience Act (Regulation (EU) 2024/2847). Where that regulation requires it, we report actively exploited vulnerabilities and severe security incidents to ENISA and the relevant CSIRT on the required timeline. Reporting a vulnerability to us does not create any obligation on your part under that regulation — the obligation is ours.

Questions about this policy that are not themselves vulnerability reports can go to security@cirrus-link.com as well.