Security Incident Reporting
ODVA is committed to resolving vulnerabilities to meet the needs of its members, licensed vendors, and the broader CIP technology community. The digital security research community plays a real role in that effort, and ODVA welcomes reports from anyone who identifies a potential vulnerability in our products, specifications, or services.
The sooner we know, the sooner we can act — to protect our members and strengthen the confidentiality, availability, and integrity of the systems they rely on.
Found something? Email our Security Incident Response Team at [email protected] if you’ve identified a potential vulnerability in an ODVA product, specification, or service.
Help us move fast
A complete first report gets you a faster response. Please include:
- Date and time the vulnerability was observed
- What the vulnerability is
- How to reproduce it — steps, a video, or screenshots all work as proof of concept
- Your name and company
- Your disclosure plans and timeline
- Whether you’d like public credit for the find
- How you’d like to be reached — email, phone, or anonymously
- Your PGP public key, if you want our reply encrypted
What comes next
Once your report lands, someone from the team will follow up directly. ODVA targets acknowledgment of every report within seven days. For the full picture of how vulnerabilities move from report to resolution, see PUB00365R0, the ODVA Vulnerability Handling Policy.
ODVA does not pay for vulnerability discoveries.
How to reach us
[email protected] exists for one thing: reporting security vulnerabilities in ODVA products, specifications, or services. Sending anything sensitive? Encrypt it — our team can send and receive PGP-encrypted mail. Download PGP Public Key for [email protected]
Security Advisories
No security advisories related to ODVA technologies are currently published.