01 Purpose

IDP is committed to continuously improving the security of its products. We welcome reports of potential security vulnerabilities from security researchers, customers, and users. This policy describes how to report a vulnerability in an IDP product and how IDP handles and discloses reported vulnerabilities.

02 Scope

This policy applies to:

• Card printers, laminators, multi-hoppers, kiosk equipment, and related hardware products developed, manufactured, and sold by IDP
• Firmware for the above products
• Drivers, utilities, SDKs, and mobile applications distributed by IDP
• Websites and online services operated by IDP

The following are out of scope:

• Products and software that have reached the end of their support period
• Products and services manufactured or operated by third parties
• Attacks requiring physical access to, theft of, or loss of a device
• Social engineering and phishing directed at IDP employees
• Configuration recommendations and informational findings with no demonstrable security impact

03 How to Report

Please report vulnerabilities to: “security@idp-corp.com” Report a Vulnerability Including the following information will help us validate your report quickly:

• Affected product name and model number
• Firmware or software version
• Type of vulnerability and a detailed description
• Steps to reproduce the vulnerability, including proof-of-concept code or screenshots where applicable
• Expected impact and attack scenario
• Your contact details and whether you wish to be credited
• Your intended publication date, if you plan to publish the vulnerability

Reports are accepted in English or Korean.

04 Our Process and Response Times

After receiving a report, IDP will:

• Acknowledge receipt within 3 business days.
• Provide an initial assessment, including whether we consider the reported issue to be a vulnerability and our preliminary severity rating, within 10 business days.
• Provide a status update every 30 days while remediation is in progress.
• Notify you when a fix or mitigation has been released.

Remediation time depends on the severity of the vulnerability, the range of affected products, and the validation required. IDP aims to resolve high-severity vulnerabilities within 90 days of the initial report and, where an immediate fix is not feasible, to provide mitigation guidance first. These are target timeframes, not guarantees.

05 Disclosure

• IDP follows a coordinated disclosure process. We publish information about a vulnerability after a fix or mitigation has been made available to users.
• The disclosure date is agreed with the reporter and, absent exceptional circumstances, will be within 90 days of the initial report.
• Where we consider that publication would create additional risk for users before they have had an opportunity to apply a fix, we may delay disclosure until users have had a reasonable opportunity to do so. We will explain our reasoning to the reporter.
• Published security advisories include the affected products and versions, a description of the vulnerability, its severity, and the actions users should take.
• We credit reporters in our advisories where they wish to be credited and respect requests to remain anonymous.

06 Guidelines for Researchers

When investigating and reporting vulnerabilities, please:

• Test only on devices you own or are explicitly authorised to test.
• Do not access, store, transfer, or use the personal data of others. If you encounter such data, stop immediately and inform us in your report.
• Do not disrupt services, destroy data, or degrade system performance.
• Limit your activity to what is necessary to demonstrate the vulnerability.
• Do not disclose or share vulnerability information with third parties before coordinating with IDP.
• Do not demand payment or other consideration in exchange for vulnerability information.

07 Safe Harbour

If you investigate and report a vulnerability in good faith and in accordance with Section 6 of this policy, IDP considers your activity to be authorised. We will not initiate or support civil or criminal action against you in connection with such activity. If a third party brings legal action against you in connection with research conducted under this policy, we will make it known that your activity was carried out in accordance with this policy.
This section applies to the extent permitted by applicable law and does not apply to any activity that breaches Section 6.

08 Rewards

IDP does not currently operate a monetary bug bounty programme. We recognise reporters by crediting them in our security advisories.

09 Reporting to Authorities

Under the EU Cyber Resilience Act and other applicable laws, IDP may be required to notify the relevant authorities of actively exploited vulnerabilities and severe security incidents. Where such notification is required, we will make it within the applicable statutory deadlines. We will not include a reporter's personal data in such notifications without their consent, unless otherwise required by applicable law.

10 Changes to This Policy

This policy may be revised in response to changes in applicable laws and our operational experience. Revisions will be published on this page together with the revision date.