Product Security (PSIRT)

Janome Corporation has established a Product Security Incident Response Team (PSIRT) to help ensure our customers can use our products safely and securely, and we are committed to maintaining appropriate cybersecurity throughout the entire product lifecycle.

Product Security Policy

https://www7.janome.co.jp/global/productsecurity

Security Advisories

https://www.janome.co.jp/psirt/vulnerability-advisories.html

Vulnerability Disclosure Policy (VDP)

1. Collection of vulnerability information

We collect vulnerability information related to our products.
If you discover the vulnerability in any of our products, please report it using the Vulnerability Reporting Form.

If you contact us through this service, we will send an email acknowledging receipt of your message based on the information you provide.
We also welcome vulnerability information submitted through other communication channels.

However, as a rule, we do not respond to reports that fall into any of the following categories.
For general inquiries, please contact us here.

・Reports concerning known issues or products that have reached end of support
・Reports that lack sufficient detail or reproducibility
・Reports outside the scope of our control
・Reports that are not related to security
・Reports concerning services (web services, websites, online platforms, etc.)
・Other reports, including social engineering attempts, advertisements, spam, or other inappropriate communications

2. Report content

i. Contact Details (e.g., email address)
ii. Affected product information
iii. Vulnerability details (environment, reproduction steps, and verification results or a proof of concept [PoC])
iv. Expected Impact (e.g., Confidentiality, Integrity, Availability)

3. Investigation and countermeasures

The relevant product team will promptly investigate and address the vulnerability you reported.
Please note that we may request additional information as needed.
We will also provide periodic progress updates until the issue is resolved.

4. Disclosure of vulnerability information

We will publish Security Advisories after completing the necessary countermeasures for our products.

Upon request, we will acknowledge the contributor of the initial report in the advisory.

Please note that the disclosure date may exceptionally be delayed if it poses a security risk.

During disclosure coordination, access to undisclosed vulnerability information is strictly limited to authorized parties to minimize the risks of unauthorized disclosure.

5. Response policy

Post-release, we promptly conduct security testing and provide updates to address the evolving threat landscape and new vulnerabilities.