Affected product
Name the product, release, commit or service, including the relevant configuration.
Product Security
Report vulnerabilities securely to the o6 Product Security Incident Response Team.
Report a vulnerability privately.
Please do not open a public issue or publish technical details before we have coordinated a response.
Secure email
Send reports to either psirt@o6-automation.com or open62541-security@googlegroups.com. You can encrypt sensitive reports and attachments sent to either address with the same public key.
C969 F334 7BA6 31BD 5686 9514 AE55 28D6 D703 B17C
Help us assess the issue quickly.
A useful report gives us enough context to reproduce the problem and understand its impact.
Security impact
Describe what an attacker could achieve and which assumptions or access are required.
Reproduction
Provide clear steps, a minimal proof of concept, and relevant logs or traces.
Disclosure status
Tell us whether anyone else knows, whether exploitation is suspected, and how you wish to be credited.
What happens after your report.
The response is coordinated around technical risk, affected users, and the availability of a safe mitigation.
Acknowledgement
We confirm receipt and establish a private channel for follow-up questions.
Assessment
We reproduce the issue, assess severity, and determine affected products and versions.
Mitigation
We prepare and validate fixes or practical mitigations with the necessary maintainers.
Coordinated disclosure
We agree on publication timing and acknowledgement after users can protect their systems.
Good-faith security research.
We value responsible research that avoids privacy violations, data destruction, service disruption, and unnecessary access to third-party systems. Please give us a reasonable opportunity to investigate and coordinate remediation before publication.
This channel is for potential security vulnerabilities. For product support, licensing, or general enquiries, please use our contact page.