Security support

The support period, how to report a vulnerability, and what every release build checks.

Support period

Each BooleX release receives security updates for five years from its release date. The release notes state the end date. Security updates are signed release packages installed offline: see Updates and decommissioning.

Reporting a vulnerability

• Report it through GitHub private vulnerability reporting on the BooleX repository (Security → Report a vulnerability), or to the customer security contact named in the site's support agreement.
• Reports are acknowledged within 5 working days. A fix or mitigation is targeted within 30 days for a vulnerability scored CVSS 7.0 or higher, and within 90 days otherwise.
• Sites are told of an actively exploited vulnerability, and of each fix, through their support contact.

What each release build checks

• No component in the release's software bill of materials may have a known vulnerability scored CVSS 7.0 or higher, unless it is listed with its reason and review date as an accepted exception.
• The release ships secure by default: the production profile, HTTPS only, no cloud model providers, and no remote support, integration API or live parts connector until an administrator turns them on.

The security evidence pack

Every release package carries: the network flows per profile, the connector account rights, the IEC 62443-3-3 SL 1 mapping, the personal data description, the SBOM and this support statement.