Vulnerability Disclosure Policy (VDP) — UDS Atom®

Step AT's commitment to the security of UDS Atom®

At Step AT, the security and resilience of UDS Atom® are at the heart of our industrial commitments. We support the work of researchers and the cybersecurity community to identify and fix any vulnerability in a responsible and transparent way.

Scope

This policy applies to the following products and services:

• The UDS Atom® Edge Agent software (all versions under active support).
• The native connectors and communication modules developed by Step AT.
• The administration APIs and associated web interfaces.

Reporting a vulnerability

To report a security flaw, please send a message to our team:

• Email address: security@stepat.com Copy
• PGP public key: Download the PGP key
• Accepted languages: French, English.

Please include in your report:

1. A detailed description of the vulnerability and its potential impact.
2. The key steps to reproduce the problem (PoC, screenshots, event logs).
3. The affected versions of UDS Atom® and the environment (OS, hardware).

Commitments and handling times

• Acknowledgement of receipt: within 48 business hours.
• Initial assessment: within 5 business days.
• Handling: priority treatment of critical flaws and regular progress updates.

In accordance with the requirements of the European Cyber Resilience Act (CRA), actively exploited vulnerabilities are notified to the competent authorities (ANSSI / national CSIRT).

Rules of good conduct (Safe Harbor)

To protect our customers' infrastructure and data, we ask that you:

• Do not exploit the vulnerability to access or alter production data.
• Do not carry out denial-of-service attacks (DoS/DDoS) on our systems or our customers' systems.
• Keep the technical details confidential until an official fix is available.

If you respect these conditions, Step AT commits not to take legal action against people who report a vulnerability.

Our approach to the Cyber Resilience Act