1. PURPOSE

Lighthouse (UK) Ltd is committed to ensuring the security of our products and services throughout their lifecycle,
and to protecting our users and customers.
The Vulnerability Disclosure Policy describes how security vulnerabilities can be reported to us and how we handle
such reports.

2. SCOPE

This policy applies to our products with digital elements and related components we maintain.
Lighthouse (UK) Ltd does not accept the following reports:
• Vulnerabilities in products that are longer supported
• Social engineering attacks
• Denial-of-service attacks
• Vulnerabilities that cannot be reproduced
• Vulnerabilities that have already been disclosed
• Reports indicating non-compliance with the security guidelines

3. LIFECYCLE

The lifecycle of the products listed below relates to any product that is current generation or manufactured in the
last 5 years.
• CJ80
• Letatwin
• CJ-Pro II
• CPM-100 G5
• CPM-100 HG5
• CPM-100 SHG5
• CPM-200

4. REPORTING OF VULNERABILITY

If a vulnerability is discovered in Lighthouse (UK) Ltd.’s products, please report on the website using the following
link https://www.lighthouse.uk.com/security-vulnerability/ providing the following information:
• Product name and serial number
• Description of the issue
• Impact of the vulnerability
• Your contact details
Lighthouse (UK) Ltd will acknowledge receipt of the report within seven working days, and may request further
information if required. The reporter will be kept informed as appropriate until remediation is available.
Lighthouse (UK) Ltd does not provide any rewards, regardless of the content of the report.

5. REMEDIATION AND DISCLOSURE APPROACH

Lighthouse (UK) Ltd will prioritise remediation based on severity and exploitability. We aim to provide a fix or
mitigation within 90 days where feasible, and we will coordinate extensions when necessary.
Once countermeasures for vulnerabilities in the products and services are completed, we will coordinate with
relevant organisations to schedule the disclosure information. This information, including details of the
vulnerabilities and corresponding corrective measures will be published on our website.
In addition, in accordance with applicable laws and regulations, Lighthouse (UK) Ltd will report to external security
authorities and coordinating organisations as required.