PSIRT - Vulnerability Disclosure Policy

Basic Policy

JEL Corporation ("JEL") is committed to ensuring the safe and secure operation of its wafer handling robots for semiconductor manufacturing equipment and related products.
We recognize product security as a critical component of product quality.
To support this commitment, JEL has established a Product Security Incident Response Team (PSIRT) responsible for receiving, assessing, and responding to vulnerability information related to our products.
We investigate reported vulnerabilities and provide appropriate information regarding countermeasures and remediation to our customers and stakeholders.

Scope

This policy applies to products designed, manufactured, and supplied by JEL Corporation, including:
●Wafer handling robots, controllers, control boards, and material handling systems (such as EFEMs and sorters)
●Software and firmware incorporated into or provided with the above products
This policy does not apply to:
●Products that have reached their end-of-support date
●Issues arising from customer modifications or unauthorized alterations
●Issues attributable to third-party products or services outside JEL's control
●Vulnerabilities affecting JEL's corporate website

Reporting Process

If you discover a vulnerability in any of our products, please report it to us using the email address provided below.
Because vulnerability reports may contain sensitive information, such as personal contact details and vulnerability-related technical data, subsequent communications will be handled in accordance with the instructions provided by our team after we receive your report.

Information Requested When Reporting a Vulnerability

To assist us in investigating and responding to reported vulnerabilities, please provide the following information whenever possible:
●Serial number of the affected product
●Description of the vulnerability and its potential impact
●Steps required to reproduce the issue and the validation method used (including system configuration and conditions, if available)
●Contact information for the reporter
For additional information, please refer to the Vulnerability Reporting Contact section below.

Our Response Process

Upon receiving a vulnerability report, JEL will take the following actions:

1. Acknowledgment of Receipt

JEL will acknowledge receipt of the report within ten (10) business days of submission, excluding extended holiday periods.

2. Investigation

Relevant departments will assess the reported vulnerability to determine its reproducibility and potential impact.
Additional information may be requested from the reporter if necessary.

3. Remediation

If the reported issue is confirmed to affect a JEL product, appropriate corrective actions will be taken.
These may include the release of updated software or firmware, or the development of mitigation measures and workarounds.

4. Communication with the Reporter

JEL will provide updates on the status of the investigation and remediation efforts, as appropriate.

Vulnerability Disclosure

Once appropriate remediation measures have been developed and are ready for deployment, JEL will publish a security advisory on its website describing the nature of the vulnerability and the recommended mitigation or corrective actions.
JEL values the contributions of security researchers and other individuals who responsibly report vulnerabilities and assist in their resolution.
While JEL expresses its appreciation for such contributions, JEL does not offer financial rewards and does not publicly identify reporters.

Reporter Responsibilities

To support the responsible handling and remediation of vulnerabilities, JEL requests that reporters comply with the following requirements:
●Do not disclose any discovered vulnerability to third parties before JEL has published the relevant security advisory or remediation information.
●During vulnerability research and verification activities, do not engage in activities that may result in data destruction, data modification, service disruption, unauthorized access to personal information or confidential information, or any other actions that violate applicable laws or regulations.
JEL will not pursue legal action against individuals who, in good faith, report vulnerabilities in accordance with this policy and the applicable laws and regulations.

Changes to the Vulnerability Disclosure Policy

JEL may revise this Vulnerability Disclosure Policy from time to time at its sole discretion.
Any revisions will be posted on this website and will become effective upon publication unless otherwise specified.
By continuing to access or use this website following the publication of any revisions, users agree to be bound by the updated Vulnerability Disclosure Policy.

Contact Us

For vulnerability reports and product security-related inquiries concerning JEL products, please contact JEL PSIRT at the email address provided below.

Vulnerability Reporting Contact

To help us investigate and address reported vulnerabilities efficiently, please provide the following information and send it to us by email.
【Required Information】
● Company Name
● Name
● Telephone Number
● Email Address
● Affected Product Name
● Serial Number of the Affected Product
● Description of the Vulnerability and Its Potential Impact
● Steps to Reproduce / Verification Method (including system configuration and conditions, if available)

E-mail: (PSIRT Contact Information)

---