NeuroCheck Vulnerability Disclosure Policy

NeuroCheck takes the security of its products seriously and welcomes the responsible disclosure of potential product vulnerabilities. This Vulnerability Disclosure Policy (VDP) describes how security researchers, customers, and other reporters can report suspected or confirmed product vulnerabilities to NeuroCheck. For the purposes of this policy, the term product vulnerability refers to security vul-nerabilities and other security-relevant defects in our products.

If you suspect or discover a security vulnerability in one of our products, we encourage you to report it to us. We will promptly review all reports. For valid reports, we will take appropriate remediation measures.

Reporting Product Vulnerabilities

Please use the following email address exclusively to report product vulnerabilities: security@neurocheck.com. It serves as the Single Point of Contact (SPoC) for reporting product vulnerabili-ties to NeuroCheck. This helps ensure that your report reaches the responsible PSIRT directly and can be processed as quickly as possible.

Information Required for Vulnerability Reports

Please describe the product vulnerability as clearly and comprehensively as possible, including suffi-cient technical details to allow us to assess it. Each report must include the following mandatory infor-mation:

• Affected product and version
• License number or serial number (if known)
• Description of the product vulnerability
• Steps to reproduce
• Impact and/or risk
• Reporter’s contact information

Optional, but highly helpful information may include:

• Proof of concept
• Logs / screenshots
• CVSS assessment
• Workarounds

Handling of Vulnerability Reports

Upon receiving a report of a product vulnerability, we will take the following steps:

• We will acknowledge receipt of every report without undue delay.
• We will review and assess each reported product vulnerability.
• We will keep the reporter reasonably informed about the progress of the product vulnerability handling process.
• We treat all information provided as confidential and use it solely for the purpose of handling the product vulnerability.
• We coordinate the disclosure of confirmed product vulnerabilities in accordance with the prin-ciples of Coordinated Vulnerability Disclosure (CVD).
• We reserve the right to determine the nature and scope of appropriate remediation measures at our sole discretion.
• We will not pursue legal action against good-faith reporters who act responsibly and in accord-ance with this policy.

Coordinated Vulnerability Disclosure

Please do not disclose any information about a reported product vulnerability until NeuroCheck has had the opportunity to assess the vulnerability and provide appropriate remediation measures. Neu-roCheck aims to coordinate the disclosure of confirmed product vulnerabilities with the reporter in accordance with the principles of CVD.

Guidance for Vulnerability Reporters

Please conduct only research that does not impair our systems or the systems of our customers. In particular, do not perform denial-of-service attacks (DoS attacks) or other activities that affect the availability of services, access personal data, or engage in any activity that violates applicable law.

We appreciate all reporters who help improve the security of our products through responsible vulner-ability reporting.

Document Information:

• Version: V01
• Effective Date: 17 August 2026
• Last Updated: 18 August 2026
• PDF Version: PSIRT-VDP_EN_V01.pdf