Reporting a security vulnerability in a GoMax product
GoMax Electronics, Inc. takes the security of its products seriously. This page applies to all products designed and manufactured by GoMax under its brands, including GoMax, O1Stream and Formosa Drone. If you believe you have found a security vulnerability in one of our products or in the firmware or software we provide for them, please tell us so that we can investigate and fix it.
How to report
Send an e-mail to security@gomax-electronics.com.tw. Please include, as far as possible:
· the product model and, if known, the hardware revision and firmware or software version;
· a description of the vulnerability and its potential impact;
· step-by-step instructions to reproduce it, with any sample code, logs or screenshots;
· whether the issue has already been disclosed anywhere, and how we can contact you for follow-up.
Please do not include customer data or any information that does not belong to you.
What you can expect from us
· We will acknowledge your report within three (3) working days.
· We will give you an initial assessment within ten (10) working days and keep you informed of our progress.
· If the report is confirmed, we will work on a fix or a mitigation and notify affected customers through our product change notification process.
· We ask that you give us a reasonable time, normally ninety (90) days from acknowledgement, to address the issue before any public disclosure. We are happy to coordinate the timing and content of a disclosure with you.
· We will credit you for the finding if you wish.
Our commitment
GoMax follows a coordinated vulnerability disclosure practice and meets its obligations as a manufacturer under the EU Cyber Resilience Act (Regulation (EU) 2024/2847). We will not take legal action against researchers who report vulnerabilities to us in good faith, act in accordance with this page, do not access or alter data that is not their own, and do not disrupt our services or those of our customers.
Scope
This page covers GoMax products, their firmware and any software or documentation we distribute for them. For questions that are not security-related, please use the normal contact channels on this website. Vulnerabilities in third-party components should also be reported to the component vendor; we will coordinate with them where our products are affected.
