Vulnerability Disclosure Policy

August 19, 2026

Report a cyber security vulnerability

This page provides guidance on how to report a security vulnerability identified within the MachineWorks or Polygonica software libraries.

Vulnerability Disclosure Policy

This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to MachineWorks. We recommend you read this policy in full before submitting any reports to us, and always act in compliance with it.

MachineWorks take cybersecurity issues seriously and value reports of security vulnerabilities. However, we do not offer monetary rewards for vulnerability disclosures.

Reporting

If you believe you have found a security vulnerability, please submit your report to us using the MachineWorksor Polygonica technical support portal. Please include the keyword 'Cybersecurity' in the title of the ticket; doing so will allow us to flag the report for high-priority investigation.

In your report, please include details of:

• The software and version where the vulnerability can be observed
• Description of the vulnerability
• Steps to reproduce along with any necessary data. These help to ensure that the report can be triaged quickly and accurately and also reduces the likelihood of duplicate reports.
• Confirmation if the vulnerability is being actively exploited, including any available details.

What to Expect

After a real security vulnerability has been reported we will acknowledge receipt within 3 working days. Weaim to triage your report and respond to you within ten working days.

Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. We'll also aim to keep you informed of our progress. You are welcome to enquire on the status, but should avoid doing so more than once every 14 days. This allows our teams to focus on the remediation. We will notify you when the report vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.

We aim to provide software patches containing a resolution for the problem with 90 days but may require extensions for complex problems.

Guidance

You must not:

• Break any applicable law or regulations
• Attempt any form of denial of service attack, e.g. overwhelming a service with a high volume ofrequests
• Submit reports detailing non-exploitable vulnerabilities, or reports indicating that the software does notfully align with 'best practice'
• Communicate any vulnerabilities or associated details other than by the means described here.
• Use social engineering to expose non-technical vulnerabilities
• Demand financial compensation as a condition to disclose any vulnerabilities

Legal Safe Harbour

MachineWorks will not pursue legal action against researchers who:

• Make good-faith efforts to comply with this policy
• Avoid accessing, modifying or deleting user data
• Avoid privacy violations, data destruction and service disruption
• Do not exploit vulnerabilities beyond necessary demonstration
• Report findings promptly and allow reasonable remediation time
• Do not publicly disclose before coordinated timeline

This safe harbour covers activities that might otherwise violate:

• Computer fraud and abuse laws
• Data protection regulations
• Terms of service provisions