SolidRun Product Security

How to report a security vulnerability in a SolidRun product, and where SolidRun publishes security information for its platforms.

Reporting a vulnerability

If you believe you have found a security vulnerability in a SolidRun product, please tell us:

• Email [e-mail]
• Or use the reporting form at solid-run.com/sirt-reporting

Either route reaches SolidRun's Security Incident Response Team (SIRT) directly. A report opens a ticket with our security team the moment you send it.

Please include as much of the following as you can: what the vulnerability is and what an attacker gains from it, how to reproduce it, the affected product and hardware revision, and the software versions involved (BSP or image, kernel, U-Boot, BIOS). If you know the issue is already being exploited in the wild, say so prominently, because that changes how quickly we have to act.

Please do not report security issues through our community forum, a public issue tracker, general support or a sales contact, and please give us the chance to investigate and ship a fix before disclosing publicly.

Who we are

SolidRun's Security Incident Response Team receives and coordinates all product security reports. SIRT is SolidRun's single point of contact for product security matters, including for the purposes of Article 13(8) of Regulation (EU) 2024/2847 (the Cyber Resilience Act).

Coming to this section

We are preparing the following and will publish it here:

• Our coordinated vulnerability disclosure policy, setting out what you can expect from us once you report an issue
• An archive of security advisories for fixed vulnerabilities, with affected and fixed versions, CVE identifiers and remediation guidance
• Software bills of materials for our builds

Until then, the two contact routes above are live and monitored.

Product documentation

For hardware manuals, BSPs, BIOS images, drivers and quick start guides, see the SolidRun Developer Center.