How to report a vulnerability, how Faststream handles one, and what security commitments apply to engagements. A supplier without a disclosure process does not have fewer vulnerabilities; it has fewer that anyone has told them about.
Email info@faststreamtech.com with the subject line beginning SECURITY. Include what you found, how to reproduce it, and what you assess the impact to be. A machine-readable contact is published at /.well-known/security.txt.
Within three working days, from a person rather than an autoresponder.
Reproduction, impact assessment and identification of which products, versions or engagements are affected. We will tell you what we conclude, including if we conclude it is not a vulnerability and why.
A fix developed and, where a customer product is affected, coordinated with that customer so a patch and an advisory arrive together.
Coordinated. We will agree a timeline with you rather than impose one, and we will not threaten a researcher who reports in good faith.
Acknowledged by name if you want it, and not if you do not.
| Area | Practice |
|---|---|
| Confidentiality | Customer designs, data and identities are not disclosed. Case studies are published at property level with names omitted unless disclosure is explicitly approved |
| Access control | Programme material accessible to the assigned team, not to the organisation generally |
| Data location | Established at scoping where residency or export control requires it, and honoured by design rather than by policy |
| Development environment | Segregated per customer where the engagement requires it |
| Third-party IP | Licence terms honoured; provenance of anything integrated into a customer design recorded |
| Departure | Access revoked on team change; material returned or destroyed on request at engagement end |
| Subprocessors | Named, and used only where the customer agreement permits |
Faststream does not describe any system it builds as impossible to attack. A tamper-evident design is described as tamper-evident. Assurance is a matter of degree, and the degree appropriate to an application is established during engagement rather than asserted on a website.
Nor does this page claim a certification Faststream does not hold. Which security certifications and attestations apply is confirmed at enquiry, for the same reason as everywhere else: a stale claim is worse than no claim.
Email info@faststreamtech.com with a subject line beginning SECURITY, describing what you found, how to reproduce it and the impact you assess. A machine-readable contact is published at /.well-known/security.txt. Acknowledgement comes within three working days.
No, where the report is made in good faith, avoids privacy violations and data destruction, and allows reasonable time to respond. We also do not require an NDA as a condition of receiving a report.
Access is limited to the assigned team rather than the organisation, environments are segregated per customer where the engagement requires it, data location is established at scoping, and material is returned or destroyed on request at engagement end.
Tell us the specification, the constraint and the deadline. Programmes that cross silicon, radio, embedded and AI are where Faststream is strongest.