Impulse Dynamics, leading device manufacturer in CCM^® therapy, is committed to ensuring the safety and security of our customers. Toward this end, Impulse Dynamics outlines our policy for accepting vulnerability reports in our products. We seek to foster an open partnership with the security community, and we recognize that the work the community does is important in continuing to ensure safety and security for all of our customers.

We have developed this policy to both reflect our corporate values and to uphold our legal responsibilities to good-faith security researchers that are providing us with their expertise.

Initial Scope

Impulse Dynamics’ Vulnerability Disclosure Program initially covers both medical devices, health software, and Impulse Dynamics’ infrastructure.

Researchers who submit a vulnerability report to us will be given full credit on our website once the submission has been accepted and validated by our product security team

Legal Posture

Notable Rules:

We will not engage in legal action against individuals who submit reports through our Vulnerability Reporting process and enter into a legal agreement with us. We agree to work with individuals who:

• Engage in testing of systems/research without harming Impulse Dynamics or its customers.
• Perform tests on products without affecting customers, or receive permission/consent from customers before engaging in vulnerability testing against their devices/software, etc.
• Engage in vulnerability testing within the scope of our vulnerability disclosure program in accordance with the terms and conditions of any agreements entered into between Impulse Dynamics and individuals.
• Adhere to the laws of their location and the location of Impulse Dynamics. For example, violating laws that would only result in a claim by Impulse Dynamics (and not a criminal claim) may be acceptable as Impulse Dynamics is authorizing the activity (reverse engineering or circumventing protective measures) to improve its system.
• Refrain from disclosing vulnerability details before any mutually agreed-upon timeframe expires.
• The discloser’s actions must not be disproportionate, such as:
  a) Using social engineering to gain access to the system.
  b) Building his or her own backdoor in an information system with the intention of then using it to demonstrate the vulnerability, as doing so can cause additional damage and create unnecessary security risks.
  c) Utilizing a vulnerability further than necessary to establish its existence.
  d) Copying, modifying or deleting data on the system. An alternative for doing so is making a directory listing of the system.
  e) Making changes to the system.
  f) Repeatedly gaining access to the system or sharing access with others.
  g) Using brute force attacks to gain access to the system. This is not a vulnerability in the strict sense, but rather repeatedly trying out passwords.

Prioritization:

What we would like to see from you:

• Reports written in English.
• Reports that include proof‐of‐concept code, which will better equip us to triage.
• How you found the vulnerability, the impact, and any potential remediation.
• Any plans or intentions for public disclosure.

Note: Reports that include only crash dumps or other automated tool output may receive lower priority.

What you can expect from us:

• A timely response to your email (within 2 business days).
• After triage, we will send an expected timeline, and commit to being transparent as possible about the remediation timeline as well as on issues or challenges that may extend it.
• An open dialog to discuss issues.
• Notification when the vulnerability analysis has completed each stage of our review.
• Credit after the vulnerability has been validated and fixed.

Reporting Procedure

1. Please use our PGP public key to encrypt any email submissions to us.
2. Please provide us with your reference/advisory number and sufficient contact information, such as your organization and contact name so that we can get in touch with you.
3. Please provide a technical description of the concern or vulnerability.
   a) Please provide information on which specific product you tested, including product name and version number; the technical infrastructure tested, including operating system and version; and any relevant additional information, such as network configuration details.
   b) For web based services, please provide the date and time of testing, URLs, the browser type and version, as well as the input provided to the application.
4. To help us to verify the issue, please provide any additional information, including details on the tools used to conduct the testing and any relevant test configurations. If you wrote specific proof-of-concept or exploit code, please provide a copy. Please ensure all submitted code is clearly marked as such and is encrypted with our PGP key.
5. If you have identified specific threats related to the vulnerability, assessed the risk, or have seen the vulnerability being exploited, please provide that information also PGP-encrypted.
6. If you communicate vulnerability information to vulnerability coordinators such as ICS-CERT, CERT/CC, NCSC or other parties, please advise us and provide their tracking number, if one has been made available.
7. When possible, provide the report in English to expedite the process.