home
arrow
Coordinated Vulnerability Disclosure Policy

Coordinated Vulnerability Disclosure Policy

Divider Line
Disti CorporationDisti CorporationDisti Corporation
Disti Corporation

1. Our commitment

The DiSTI Corporation (“DiSTI”) takes the security of its products seriously. We welcome reports from security researchers, customers, partners and anyone else who believes they have found a security vulnerability in a DiSTI product. This policy explains how to report a vulnerability, what you can expect from us, and how we disclose and fix vulnerabilities.

This policy is DiSTI’s coordinated vulnerability disclosure policy and single point of contact forvulnerability reports under Regulation (EU) 2024/2847 (the Cyber Resilience Act), Article 13(17) andAnnex I, Part II. It follows the principles of ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC30111 (vulnerability handling).

2. Scope

This policy covers the following DiSTI products, in all currently supported versions:

  • GL Studio® Editor, including the Code Generator and its code-generation templates
  • GL Studio runtime libraries (shared and static builds) distributed for use in customerapplications
  • GL Studio Reusable Simulation Objects (RSOs) and their associated content
  • GL Studio installers, license-key and dongle mechanisms, and security updates DiSTI distributes

The following are outside the scope of this policy:

  • Applications built by DiSTI’s customers with GL Studio (“Derivative Works”). Please report those to the organization that supplies the application. If the issue lies in DiSTI’s runtime libraries or generated code, that organization may report it to us, or you may report it to us directly.
  • Third-party and open-source components distributed with GL Studio, which are listed in the “licensing” folder of the installation. You may report these to us; we will coordinate with the component’s maintainer, as Article 13(6) of the Cyber Resilience Act requires, but the maintainer’s own disclosure policy may also apply.
  • DiSTI’s corporate websites and IT systems, except where an issue affects the integrity of product downloads or updates.
  • Denial-of-service testing, social engineering, physical attacks, and spam.

3. How to report a vulnerability

Send your report to [security@disti.com]. Reports may be written in English. DiSTI’s security contact details are also published in machine-readable form at [www.disti.com/.well-known/security.txt].

A useful report includes:

  • the product, version and platform (operating system, compiler, shared or static runtime build) affected;
  • a description of the vulnerability and its potential impact;
  • steps to reproduce, with a proof of concept where possible;
  • whether you believe the vulnerability is being actively exploited; and
  • how you would like to be credited, if at all, and any planned disclosure date.

Export-controlled and classified information. DiSTI is a U.S. defense contractor. Do not send classified information, Controlled Unclassified Information, or technical data controlled under the ITAR or EAR through this channel. If your report involves such information, for example because the vulnerability was found in a defense program, send only a short notice that a report exists, without technical details, and we will arrange an appropriate channel with you.

4. What happens after you report

Stage Target
Acknowledgment of your report Within 3 business days
Initial assessment and severity rating (CVSS) Within 10 business days
Status updates while we work on a fix At least every 30 days
Security update or mitigation available Typically within 90 days of acknowledgment; sooner for critical or actively exploited issues
Public security advisory When the security update is available (see Section 5)

These are targets, not guarantees. Complex issues, or issues in third-party components, can take longer; if so we will tell you why and agree a revised timeline with you. We will tell you if we conclude that a report is not a vulnerability, with our reasons.

5. Disclosure and security updates

When a security update or mitigation is available, DiSTI will:

  • make it available to all users of the affected supported versions without delay and free of charge, whether or not the user holds a current support agreement;
  • where technically feasible, provide security updates separately from feature updates;
  • distribute it through DiSTI’s authenticated download channels, with integrity protection;
  • publish a security advisory at [www.disti.com/security/advisories] describing the vulnerability, the affected products and versions, its impact and severity, and the steps users should take; and
  • request a CVE identifier for the vulnerability, and credit the reporter in the advisory unless the reporter prefers to remain anonymous.

In exceptional cases, where publishing details would put users at greater risk, DiSTI may delay public disclosure until users have had a reasonable opportunity to apply the update. Each security update remains available for download for at least ten years after it is issued, or for the rest of the product’s support period if longer.

We ask reporters to keep a vulnerability confidential until DiSTI has published its advisory, or until 90 days after acknowledgment, whichever is earlier, and to talk to us before disclosing if more time is needed. If a vulnerability is being actively exploited, we may agree a shorter timeline.

6. Actively exploited vulnerabilities

Where DiSTI becomes aware of an actively exploited vulnerability or a severe incident affecting the security of a GL Studio product, it will notify the competent authorities through the ENISA Single Reporting Platform within the time limits set by Article 14 of the Cyber Resilience Act, and will inform affected users of the issue and of any measures they can take.

7. Support periods

DiSTI states the end date of the support period (at least the month and year) for each version of GL Studio at the time of purchase. Security updates are provided for every version until the end of its support period. The current support periods are listed at [www.disti.com/security/support-periods].

8. Safe harbor

DiSTI will not pursue legal action against, or ask law enforcement to investigate, anyone who researches and reports a vulnerability in good faith and in line with this policy. For this purpose, good faith means that you:

  • test only software you are lawfully licensed to use, and do not access, modify or keep data belonging to DiSTI or to anyone else beyond what is needed to demonstrate the vulnerability;
  • do not degrade or disrupt any system, or any customer’s system or application;
  • report the vulnerability promptly to DiSTI and keep it confidential as described in Section 5; and
  • do not demand payment or other benefit in exchange for withholding or disclosing the vulnerability.

Research conducted in line with this policy is treated as authorized, and DiSTI will not treat it as a breach of the license terms that prohibit reverse engineering, to the extent that the research was needed to identify and demonstrate the vulnerability. This safe harbor does not authorize distribution of DiSTI software, license keys or generated source code, and it cannot bind third parties or override export-control or other laws.

9. No bug bounty

DiSTI does not currently offer payment for vulnerability reports. We are grateful for every report and will publicly credit reporters who wish to be named.

10. Contact and changes to this policy

Vulnerability reports: [security@disti.com]

General product support: support@disti.com

The DiSTI Corporation, 12249 Science Drive, Suite 300, Orlando, FL 32826, USA

DiSTI may update this policy from time to time. The current version is always published at [www.disti.com/security], and the version and effective date appear at the top of this page.