Governing Regulation: EU Cyber Resilience Act (Regulation (EU) 2024/2847)

At BG SPIRIT LLC, we take the security of our digital products seriously. This policy outlines our commitment to identifying, managing, and remediating vulnerabilities in in accordance with the security-by-design principles of the EU Cyber Resilience Act (CRA).

We encourage security researchers, users, and the public to report any suspected vulnerabilities to us safely and responsibly.

1. How to Report a Vulnerability

If you discover a potential security vulnerability in , please submit a confidential report to our dedicated security team:

Email Contact: hvdhhh@gmail.com

Please include the following information in your report:

  • A detailed description of the vulnerability and the component affected.
  • Step-by-step instructions or proof-of-concept (PoC) code to reproduce the issue.
  • The potential impact or exploitability of the bug.
  • Your contact information if you wish to receive updates.

2. What We Ask of You

To protect our users and infrastructure, we request that you:

  • Avoid violating privacy laws, disrupting production systems, or destroying data during your research.
  • Do not exploit the vulnerability beyond what is necessary to prove its existence.
  • Provide us a reasonable amount of time to remediate the issue before publicly disclosing any details.

3. Our Commitment and Timeline

Upon receiving a verified report, BG SPIRIT LLC will handle the vulnerability without undue delay. Our response lifecycle conforms to the following maximum SLAs:

  • Acknowledgment: We will acknowledge receipt of your report within 48 hours.
  • Triage & Validation: Our team will review and validate the vulnerability within 5 business days.
  • Remediation: We aim to develop a security update or mitigation path immediately. High-risk flaws are prioritized.
  • Public Disclosure: Once a fix or mitigation is available, we will publicly disclose the vulnerability details along with clear remediation instructions for our users.

4. Regulatory Reporting (Article 14 Compliance)

In compliance with Article 14 of the Cyber Resilience Act, if BG SPIRIT LLC becomes aware of an actively exploited vulnerability or a severe security incident within , we will formally notify the European Union Agency for Cybersecurity (ENISA) and competent national authorities within 24 hours of awareness.

5. Safe Harbor

BG SPIRIT LLC will not pursue legal action against security researchers who discover and report vulnerabilities in good faith and comply fully with this policy.

Last Updated: September 24, 2026

Coordinated Vulnerability Disclosure (CVD) Policy generated by WPLP Legal Pages