Security Vulnerabilities Reporting Policy

IMCD takes the security of our systems seriously. Despite our efforts to protect our environment, vulnerabilities may still occur.

 

If you believe you have found a security vulnerability, we appreciate your help in disclosing it to us in a responsible manner, so that we can review and address the matter where appropriate.

 

This policy applies to vulnerabilities identified in IMCD-owned public websites, applications, and digital services.

 

This policy does not authorise testing of:

 

• systems, applications, or services that are not owned or operated by IMCD;

• third-party systems or supplier environments;

• physical security controls;

• social engineering, phishing, or impersonation of IMCD employees, customers, suppliers or partners;

• denial-of-service testing or any activity that could disrupt IMCD’s operations;

• attempts to access, modify, copy, delete or exfiltrate data beyond what is strictly necessary to demonstrate the vulnerability.

 

If you are unsure whether a system is in scope, please contact us before performing any testing.

  

• Be Direct: Report vulnerabilities as soon as possible via the contact methods in our security.txt.

• Provide Detail: Include enough information to reproduce the issue (e.g., the affected URL, system or device, IP address, screenshots, or supporting information, if relevant.

• Stay Confidential: Please do not include personal data, confidential business information or other sensitive information unless strictly necessary to explain the vulnerability.

 

When researching or reporting a vulnerability, we ask that you:

• act in good faith;

• avoid privacy violations, disruption, degradation or damage to IMCD’s systems or data;

• do not access, download, alter or remove/delete data, including user data, that does not belong to you;

• do not make the vulnerability public before IMCD has had a reasonable opportunity to review and address it;

• stop testing and notify us immediately if you inadvertently access personal data, confidential information or non-public systems.

• do not perform Denial of Service (DoS) attacks.

• do not use automated scanners that generate excessive traffic.

 

IMCD will review reports submitted under this policy and determine, at its discretion, whether further action is appropriate.

Reports may be prioritised based on severity, business impact and available information. IMCD may decide, at its discretion, not to investigate reports that are out of scope, insufficiently substantiated, duplicative, theoretical, or low risk.

Where you provide contact details, we may contact you for additional information. IMCD does not commit to a specific response time, remediation timeline, or outcome. However, we aim to handle genuine security reports carefully and in good faith.

 

IMCD does not operate a bug bounty programme and does not offer financial rewards or compensation for vulnerability reports.

 

Please do not publicly disclose a vulnerability without IMCD’s prior written consent.

If you wish to publish information about a reported vulnerability, please contact us first. IMCD will assess such requests on a case-by-case basis.

 

This policy is intended to support responsible reporting of security vulnerabilities. It does not grant permission to perform unlawful activities or to access systems or data without authorisation. This policy does not create any contractual relationship, obligation to remediate, obligation to respond, or entitlement to compensation.

 

IMCD reserves all rights, including the right to take legal action where activities are harmful, unlawful, disproportionate, disruptive, or not carried out in accordance with this policy.

 

IMCD may update this policy from time to time. The version published on IMCD’s website applies at the time of reporting.