Taara Coordinated Vulnerability Disclosure (CVD) Policy

Effective: September 2026

At Taara Connect, Inc. (“Taara”), we are committed to ensuring the safety, reliability, and security of our connected products. In alignment with the EU Cyber Resilience Act (CRA), we maintain a structured process to receive, triage, and remediate security vulnerabilities reported by external researchers, customers, and partners.

If you believe you have discovered a security flaw in one of our products, we encourage you to report it to us immediately through our Single Point of Contact (SPoC) detailed below.

1. Scope

This policy applies to all hardware products, software applications, and firmware actively developed and maintained by Taara, including:

  • Lightbridge
  • Lightbridge Pro
  • Link Planner
  • Prism

Out of Scope: Third-party websites, applications, or services integrated with our products but not owned or managed by Taara.

2. Single Point of Contact (SPoC)

To report a security issue, please use one of the following secure channels:

3. Submission Guidelines

To help our engineering team verify and fix the issue quickly, please include:

  • The specific product name, model, and firmware/software version.
  • A clear, technical description of the vulnerability.
  • Proof of Concept (PoC) code or step-by-step instructions to reproduce the issue.
  • Any indication or evidence if you believe this flaw is actively being exploited in the wild.

4. Safe Harbor

If you conduct security research and report vulnerabilities in good faith according to this policy, we consider your research authorized. We will not pursue legal action against you, provided that you:

  • Do not exploit the vulnerability beyond what is strictly necessary to prove its existence.
  • Do not access, modify, or delete user data.
  • Do not disrupt or degrade our systems or products (e.g., Denial of Service attacks).