Verisurf Product Security & Vulnerability Disclosure
Verisurf provides a process for reporting potential security issues affecting supported Verisurf products. Customers, security researchers, suppliers, and others can report a potential vulnerability to security@verisurf.com.
This page explains how to report a potential product security issue, what information to include, and where to find published Verisurf security advisories and notices.
Website Security Reports
Security concerns involving verisurf.com may be reported to security@verisurf.com. Listing a Verisurf website or domain on this page does not authorize security testing, access, exploitation, or disruption of that website or its systems.
Report a Product Security Issue
To report a potential Verisurf product security issue, email security@verisurf.com.
If the issue may originate in Mastercam, a third-party component, or another supplier but affects a supported Verisurf product, please still report it to Verisurf so we can assess the impact to our product.
What to Include in a Vulnerability Report
When available, please include:
• The affected Verisurf product, version, and build.
• A clear description of the issue and the potential security impact.
• Any steps, proof of concept, or evidence you already have. Please do not expand testing beyond what has been authorized.
• Relevant logs, screenshots, files, or other supporting information that can be shared safely.
• Your contact information so Verisurf can request clarification if needed.
• Keep unrelated issues in separate reports when practical. If issues appear related, please explain the connection without expanding testing.
• Please do not send customer data, credentials, export-controlled information, or other sensitive information unless Verisurf specifically requests it and an appropriate method for sharing it has been agreed.
Scope
In Scope
At this stage, Verisurf is seeking vulnerability feedback related to the following products identified in the current CRA readiness effort:
• Verisurf
Research and Coordinated Disclosure
We ask researchers to report suspected issues promptly and avoid anything that could harm systems, data, customers, or users.
• Do not perform denial of service or other testing intended to disrupt normal service.
• Do not use social engineering, phishing, or physical attacks.
• Do not intentionally access, acquire, modify, retain, or disclose customer or third-party data. If such data is inadvertently encountered, stop the activity, avoid further access or distribution, and report it to Verisurf.
• Do not use a vulnerability to gain more access, stay in a system, or move into other systems.
• Before making vulnerability details public, coordinate with Verisurf so we have a reasonable opportunity to validate the issue and, when needed, make a fix or mitigation available. This process does not give permission to publish details or waive any legal, contractual, confidentiality, or intellectual-property rights.
• This process does not authorize security testing, access to systems or data, exploitation, or public disclosure. Any specific testing permission or safe harbor must be approved in writing by Verisurf or Sandvik Legal.
• This is not a bug bounty program and does not promise payment or recognition for a report.
Security Advisories and Notices
Published Verisurf security advisories and notices, when available, can be found through Sandvik Product Security and Sandvik Security Bulletins.
• Sandvik Product Security
https://www.home.sandvik/en/about-this-site/product-security-at-sandvik/
• Sandvik Security Bulletins
https://www.home.sandvik/en/about-this-site/product-security-at-sandvik/security-bulletins/
Mastercam Vulnerability Disclosure
Verisurf is built on the Mastercam platform. If an issue appears specific to Mastercam, see the Mastercam Vulnerability Disclosure page. If the issue affects Verisurf, please still report it to Verisurf at security@verisurf.com so we can assess the impact to our product.
https://www.mastercam.com/privacy/mastercam-vulnerability-disclosure/
Security Contact Information
Verisurf publishes security contact information in accordance with RFC 9116 at:
