Erişim varsa;
Erişim yoksa;
from the icons on the right side of the address bar. After clicking this icon, the following dialog window will appear. From here, you can continue the process by selecting your webcam equipment connected to your system.
Sign up for the E-Bulletin to be informed of innovations and developments.
Vulnerability Disclosure Procedure
This page has been prepared so that security researchers, customers and users can report security vulnerabilities in EMKO Elektronik products in a safe, responsible and coordinated manner.
PSIRT contact address: psirt@emkoelektronik.com.tr
Please do not send sensitive evidence or user data by e-mail. If necessary, contact PSIRT to agree on a secure sharing method.
1. Purpose of the Program
EMKO Elektronik aims to work with security researchers in good faith and in a coordinated way to improve the security of products with digital elements. Reported vulnerabilities are recorded and assessed by PSIRT, prioritised according to their risk level, and appropriate fixes or mitigations are planned.
This procedure is linked to the CRA-compliant CVD Policy, the Vulnerability Management Policy and the Incident Response Procedure.
2. Scope
In scope
- Products with digital elements supported by EMKO Elektronik.
- Product firmware/software components.
- Mobile applications, web portals and APIs.
- Cloud/back-end services and remote data processing solutions required for product functionality.
- Update infrastructure, signing and distribution mechanisms.
Out of scope
- Social engineering, phishing, spam or physical security testing.
- DDoS/DoS or any testing that may cause service disruption.
- Accessing, modifying, deleting or exfiltrating third-party data.
- End-of-support products, unless stated otherwise.
- Vulnerabilities affecting only corporate IT systems and unrelated to product security.
3. How to Report
Please send vulnerability reports to psirt@emkoelektronik.com.tr.
If possible, please include the following information in your report:
- Affected product, model, version, platform, API endpoint or component.
- Reproducible steps and a technical description.
- PoC, screenshots, logs or error messages, if available.
- Estimated security impact: confidentiality, integrity, availability, authentication, unauthorised access or supply chain impact.
- Your contact details and preferred secure communication method.
- Your public disclosure plan or proposed embargo period.
4. Safe Research Rules
- Test only on your own account, your own device or an explicitly authorised test environment.
- Stay at the lowest level of testing necessary to demonstrate the existence of a vulnerability.
- Do not access customer data, personal data, private keys or tokens; if access occurs, stop testing and report immediately.
- Do not install malware, establish persistence or extend privilege escalation.
- Avoid tests that may cause service disruption, resource exhaustion or performance degradation.
For good-faith, in-scope research that complies with these rules, EMKO Elektronik aims to work in coordination with the researcher.
5. Expected Response Times
| Stage | Target time | Description |
| Acknowledgement of receipt | Within 3 business days | PSIRT registers the report and provides a tracking number. |
| Initial assessment | Risk-based | Scope, reproducibility, impact and exploitability are assessed. |
| Fix / mitigation | Risk-based | High and Critical findings are prioritised. |
| Advisory / user notification | When the fix is ready | Affected versions, security updates and user actions are published. |
6. Risk Levels
Risk assessment is performed using the Likelihood × Impact model.
| Score range | Level | General action |
| 1–6 | Low | Planned backlog and regular review. |
| 7–12 | Medium | Planned remediation and the next security release. |
| 13–19 | High | Priority remediation, PSIRT follow-up and advisory preparation. |
| 20–25 | Critical | Urgent PSIRT/Incident Response activation and expedited release. |
7. Coordinated Disclosure
Researchers are expected not to publicly disclose a vulnerability without agreeing with EMKO Elektronik on a reasonable fix or embargo period. In multi-party cases, suppliers, open source maintainers, coordinators, CSIRTs or the authorised representative may be involved in the process.
Where appropriate and with the researcher's permission, EMKO Elektronik may acknowledge the contribution in an advisory or on an acknowledgements page. By default, this program does not constitute a reward or bug bounty program.
8. CRA Reporting Note
If there is an actively exploited product vulnerability or a suspected severe incident affecting product security, EMKO Elektronik triggers its internal Incident Response Procedure and evaluates its obligations under the CRA for a 24-hour early warning, a 72-hour notification and a final report.
In urgent cases, add “URGENT / ACTIVE EXPLOIT SUSPECTED” to the subject line of your report.
9. Confidentiality
Reports are processed solely for vulnerability verification, risk assessment, remediation, user notification and the fulfilment of legal/compliance obligations. Before sending evidence containing personal data or third-party data, confirm a secure sharing method with PSIRT.
10. Security.txt
EMKO Elektronik's /.well-known/security.txt information:
Contact: mailto:psirt@emkoelektronik.com.tr Preferred-Languages: tr, en Policy: https://www.emkoelektronik.com.tr/en/corporate/our-policy/vulnerability-disclosure-procedure Expires: 2027-10-19T00:00:00.000Z
EMKO Elektronik reserves the right to update this procedure when necessary. Last updated: October 2026
