BURY’s goal is to offer its customers the best possible automotive technology solutions, but not only that. As a company, we strive to constantly develop, to create new and more technologically advanced products. Despite our constant efforts on the cyber security of products and services, vulnerabilities and threats may arise as a result of new attack vectors.
The program was created to further ensure the cyber security of our products, systems or assets, so we encourage cyber security researchers from around the world to report potential vulnerabilities in their security. We appreciate your support in identifying vulnerabilities, which helps us minimize potential threats to our products, systems and assets.
Legal aspects
The Bury Group will not take legal action against researchers who investigate vulnerabilities in our products, systems and resources, provided that they follow the Product Vulnerability Reporting Regulations
By choosing to participate in this program, you agree to:
- Comply with the Regulations for reporting product vulnerabilities (link)
- Not to disclose vulnerability information and other information obtained and/or collected as part of the vulnerability reporting process (including vulnerability discovery) without prior written approval from BURY Group
Scope of the program
The following vulnerabilities are not included in the scope of the program notification:
- attacks such as Social Engineering (cookie theft, fake login pages, phishing),
- resource exhaustion attacks,
- DoS-type attacks
- ataki naruszające Regulamin zgłaszania podatności produktu.
How to report a vulnerability ?
To disclose a potential vulnerability, you must accept the Regulations for Reporting Product Vulnerabilities and send a description using the form.
* I acknowledge that I have read and agree to the Terms and Conditions for reporting product vulnerabilities.
Before completing and submitting the form, read the rules for processing personal data of the Vulnerability Notifier:
1. The Controller of your personal data is BURY Sp. z o. o. with its registered office in Mielec, ul. Wojska Polskiego 4, 39-300 Mielec. Contact with the Controller is possible via e-mail address: rodo@bury.com or mailing address: ul. Wojska Polskiego 4, 39-300 Mielec (hereinafter referred to as “Controller”).
2. Your personal data will be processed for the purpose of handling a vulnerability request submitted via the contact form and further contact with the Submitter- the legal basis for processing will be the legitimate interest of the Controller (Article 6(1)(f) RODO); the Controller’s legitimate interest is to enable the handling of the vulnerability request, including contact with the Submitter.
3. If you have given your consent to the publication of your personal data in the Hall of Fame – the legal basis for processing is consent (Article 6(1)(a) RODO). You can withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing performed before its withdrawal. For evidence purposes, the Controller requests the withdrawal of consents by written or electronic means.
4. Your personal data may be shared with providers of IT systems and services acting on behalf of the Controller. Your personal data may be shared with other Bury Group Companies to the extent necessary to handle a vulnerability report if the content of the report relates to the business area of the respective Group Company.
5. To the extent that the processing of your data is based on your consent – your personal data will be processed until you withdraw it. In other cases, your personal data will be processed for the period necessary for the Controller to handle your request, for a maximum of 6 months, and the period that is necessary to defend the interests of the Bury Group in case of the need to make claims or defend against claims, not longer than until the statute of limitations for claims, and then will be archived.
6. You have the right: to access the content of your data and to request rectification, removal and restriction of processing.
7. Notwithstanding the above, as the basis for the processing of personal data is the premise of the controller’s legitimate interest, the Controller informs about the right to object to the processing of personal data.
8. You also have the right to lodge a complaint with the data protection supervisory authority.
9. Your personal data will not be processed by automated means, including profiling. 10. Provision of data is necessary to handle the application. The consequence of failing to provide personal data will be the inability to service the request.
