Security · Responsible disclosure

Reporting a vulnerability in Gibertini software

Gibertini Elettronica S.r.l. welcomes reports of security vulnerabilities in its own software and thanks those who disclose them responsibly.

How to report

Write to

service@gibertini.com
Subject: Segnalazione di sicurezza (security report)

You do not need to be a Gibertini customer in order to submit a report.

What to include in the report

  • the product and version affected;
  • a description of the issue and the steps to reproduce it;
  • the impact you believe is possible;
  • any proof of concept or sample files;
  • how you prefer to be credited, or whether you prefer to remain anonymous.

What happens next

Stage Time
Acknowledgement of receipt within 5 working days
Initial assessment and severity classification within 15 days of the acknowledgement
Status updates at least every 30 days until closure
Fix, or reasoned statement that no action will be taken according to severity

Gibertini publishes a release note for every version that fixes a vulnerability and, unless otherwise requested, credits the person who reported it.

Coordinated disclosure

90-day deadline

You are asked not to disclose the vulnerability publicly before a fix is available, or in any case before 90 days have passed since the report, whichever comes first. If more time is needed, it can be agreed.

No legal action

Gibertini undertakes not to take legal action against anyone who reports in good faith, respects this deadline, does not access other people's data, does not degrade the service and does not exploit the vulnerability beyond what is necessary to demonstrate it.

What is not in scope

Reports concerning:

  • the configuration of the customer's workstation or network;
  • vulnerabilities in operating systems or third-party components not redistributed by Gibertini;
  • attacks requiring already privileged physical access to the workstation;
  • social engineering against staff.

Covered products and versions

Product Supported versions
GSA MultiHead versions released within the declared support period, equal to 5 years from the delivery date of the version
MicroDens Logger Pro same, 5 years
DCA Studio same, 5 years

This page is also reachable through the security.txt file, following the RFC 9116 standard. Last updated: 1 September 2026.