Security policy

Arnodiqa is made by GoTrust bv, Morelgem 24b, 9520 Vlierzele (Sint-Lievens-Houtem), Belgium (enterprise number 1037.576.138). This policy covers how to report a vulnerability in Arnodiqa, what you can expect from us, and which versions receive security updates.

Scope

In scope is everything GoTrust distributes as Arnodiqa:

• the desktop application (Windows installers, MSI and NSIS) and the components it contains;
• the command line tool (arnodiqa) and the CAPL language server (arnodiqa-capl-lsp);
• the VS Code extension;
• the installers, update bundles, documentation and the website arnodiqa.com.

Out of scope; please report these to their makers:

• drivers and libraries of hardware vendors (PEAK-System, Vector, Kvaser, …) that Arnodiqa loads but does not ship;
• the Microsoft Edge WebView2 Runtime (report to the Microsoft Security Response Center, https://msrc.microsoft.com), unless the problem lies in how Arnodiqa uses it;
• Seed & Key libraries or other code supplied by you or your OEM.

If you are unsure, report to us; with your consent we forward the report to the right party.

How to report

Email security@arnodiqa.com. An OpenPGP key for encrypted messages is available on request.

Please include:

• the Arnodiqa version (Help > About Arnodiqa, or arnodiqa --version) and the operating system;
• a description of the problem and its impact;
• steps to reproduce, a proof of concept or a minimal project file;
• whether you believe the vulnerability is already being exploited;
• how you want to be credited (name, handle, or anonymous).

Please do not send real measurement logs, keys, Seed & Key libraries or other confidential data of your own or of your customers. If we need more, we first agree on a secure way to exchange it. Arnodiqa never sends anything to us by itself; a report always comes from you.

You can write to us in English, French or Dutch.

What you can expect

Working days are Belgian working days, 9:00 to 17:00 Belgian time. The fix times are targets and do not constitute a guarantee; for complex problems we agree a date with you. An actively exploited vulnerability always gets the highest priority.

Customers with a maintenance contract can also report through support with priority P1; the response times of the maintenance terms then apply as well.

Coordinated disclosure

• We ask you to keep the vulnerability confidential until a fix is available, or until 90 days after your report, whichever comes first. If a fix needs more time, we explain why and propose a new date; we do not ask for open-ended delays.
• We publish a security advisory when the fix is available (see below) and credit you, unless you prefer not to be named.
• We request a CVE identifier for every confirmed vulnerability that affects a released version.
• If a vulnerability is actively exploited, we may publish a warning with mitigations before a fix exists, after informing you.
• When the vulnerability lies in a third-party component (for example an open-source library), we also report it to its maintainers and coordinate the disclosure with them.

Safe harbour

You may test the security of Arnodiqa on your own installations (EULA, art. 7.5). We will not take legal action against research done in good faith that respects this policy: do not access, change or destroy data that is not yours, do not disrupt systems of others (including vehicles or test benches you are not authorised to use), and give us reasonable time to fix the problem before disclosure. Coordinated disclosure is a request from us and is not a condition of your licence.

Belgian law also allows you to report vulnerabilities to the Centre for Cybersecurity Belgium (CCB), the national CSIRT, which can act as coordinator: https://ccb.belgium.be.

Supported versions

Every major version of Arnodiqa receives free security updates for 5 years, counted from the later of these two dates: the first release date of that major version, or the delivery of your licence. The end date (at least month and year) is stated in your quote or order confirmation. A security update is either a fix for your version or a later version within the same major version, free of charge, also without a maintenance contract. Each security update remains available for download for at least 10 years after its release, or until the end of the support period if that is later.

The licence agreement (EULA art. 9.4) and the maintenance terms (art. 4) are the binding texts.

Advisories and notifications

• Security advisories are published at https://arnodiqa.com/security/advisories, with the affected versions, severity, CVE, fix and mitigations.
• We inform affected customers directly by email (the address in the order, or the last address given to us for this purpose) about actively exploited vulnerabilities and severe security incidents, with the measures they can take. You can also subscribe to all security advisories by email at security@arnodiqa.com.
• Every release comes with checksums and a software bill of materials (CycloneDX) next to the installer, so you can verify it yourself.

security.txt

The machine-readable contact is published at https://arnodiqa.com/.well-known/security.txt (RFC 9116).