Security Vulnerability Disclosure
Intensecomp Pte Ltd takes the security of our products and infrastructure seriously. We welcome reports from security researchers, customers, and partners who identify vulnerabilities in our software and services.
If you believe you have found a security issue, please report it to us. We will acknowledge your report, investigate it, and keep you informed as we work toward a resolution.
Disclosure email: [email protected]
How to Report a Vulnerability
Please email [email protected] with the following details:
- Type of issue β e.g. authentication bypass, injection, insecure deserialization, exposed API endpoint, privilege escalation, or a misconfiguration.
- Affected product β which product and version (see the supported product list below).
- Steps to reproduce β detailed enough for our team to confirm the issue.
- Impact β what an attacker could achieve, and what access is required.
- Proof of concept or screenshots, if available.
- Your contact details so we can reach you with follow-up questions.
Please encrypt sensitive reports where possible, or request a secure channel in your first email and we will arrange one.
What To Expect
We follow a coordinated disclosure process aligned with industry standards:
| Stage | Our Commitment |
|---|---|
| Acknowledgement | We will confirm receipt of your report within 3 business days. |
| Triage | We will assess severity and validity, and determine whether the issue affects a supported product. |
| Updates | We will keep you informed of progress and share a remediation timeline once severity is confirmed. |
| Fix release | Patches are released for confirmed vulnerabilities in affected supported products. |
| Advisory | For high-severity issues affecting customers, we may publish an advisory describing the issue, affected versions, and remediation steps. |
Severity and Remediation Targets
Our targets for confirmed vulnerabilities in supported products:
- Critical β patch or mitigated within 15 calendar days
- High β patch or mitigated within 30 calendar days
- Medium β patch within 90 calendar days
- Low β addressed in the next scheduled release
These are targets, not guarantees. Complex issues that require changes across multiple components or third-party dependencies may take longer, and we will communicate openly about any delay.
Supported Products
The products below are actively maintained and covered by this disclosure policy. Fixes are released for the versions listed.
| Product | Category | Supported Versions |
|---|---|---|
| Inventrack 6.0 | Asset Management System | Current release branch |
| Inventrack Warehouse (WMS) | Warehouse Management System | Current release branch |
| Inventrack VMS | Visitor Management System | Current release branch |
| Inventrack POB | People On Board Tracking System | Current release branch |
| Inventrack MES | Manufacturing Execution System | Current release branch |
| Inventrack OPCUI (LIMS) | Lab Information System | Current release branch |
| Inventrack Sense | Environmental Sensor Monitoring | Current release branch |
| Inventrack Checklist | Checklist Handling System | Current release branch |
| Chemtrack | Chemical Information System | Current release branch |
If Your Product Is Not Listed
- If your product is listed and the affected version is within the supported range, a patch is available or in progress. Contact [email protected] with your version details and we will provide the fix and upgrade instructions.
- If your version is out of support, the fix may still apply to a newer release. Contact us and we will advise whether an upgrade path is available.
- If we cannot confirm a specific version, we will work with you to determine whether you are affected and what mitigation is appropriate.
We do not publish an advisory for every fixed issue. Minor and low-severity fixes are addressed silently; you will receive patch details directly if your report concerns a confirmed issue in a supported product.
Scope
In Scope
- Vulnerabilities in Intensecomp software products listed above.
- Vulnerabilities in our hosted services, APIs, and the www.intensecomp.com website.
- Weaknesses in the security configuration of our deployed software.
- Hard-coded credentials or exposed secrets in distributed builds.
Out of Scope
- Findings from automated scanners without a demonstrated, concrete impact.
- Vulnerabilities in third-party hardware or vendor firmware (Impinj readers, Times-7 readers, mobile operating systems) β please report those to the relevant manufacturer. We will assist with coordination where helpful.
- Denial-of-service attacks against our hosted infrastructure.
- Social engineering, phishing, or physical attacks against our staff or offices.
- Missing hardening headers with no exploitable security consequence.
- Reports generated solely by security scanners without manual verification.
- Weaknesses that require physical access to an already-compromised device.
- Any testing against customer-deployed systems without the customerβs explicit authorisation.
If you are unsure whether a finding is in scope, report it anyway. We will not penalise good-faith research.
Safe Harbour
We support coordinated vulnerability disclosure and commit to good-faith handling of all reports.
- We will not pursue legal action against you for research that stays within the scope above.
- We will not terminate or revoke access for Intensecomp services for good-faith research.
- We will work with you to publish an advisory with appropriate credit, if you wish to be acknowledged.
- We ask that you give us a reasonable opportunity to release a fix before public disclosure, and that you do not access or retain customer data, degrade our services, or exploit vulnerabilities against other users.
This safe harbour applies to research conducted from infrastructure you lawfully own or control. It does not extend to third-party systems, social engineering, or physical attacks.
Security Posture
Intensecomp operates an information security management system certified to ISO/IEC 27001:2022, issued by TΓV SΓD (certificate IS27-2026-0369). This certification covers our security controls, risk management processes, and operational practices, independently audited.
Our security commitments to customers are documented in our Data Processing Agreement, including breach notification obligations. For background on our company and certification, see About.
Contact
- Security disclosures: [email protected]
- General enquiries: [email protected]
- Office: Blk 1003, Bukit Merah Central, #06-23, Singapore 159836
- Telephone: +65 6278 7558