Scope
This channel exists for one reason: so Paragon can meet its Article 14 reporting duty. It is not our full vulnerability disclosure programme.
Report here if
- You have evidence a Paragon product is being actively exploited — not just theoretically vulnerable
- You’re aware of a severe incident affecting Paragon’s products or infrastructure
What happens next
- We assess against the CRA definition of “actively exploited vulnerability” (Art. 3(42))
- If it qualifies: early warning within 24h, full notification within 72h, final report within 14 days
- Notifications go to our corresponding national CSIRT and ENISA (Art. 14)
- Corresponding national CSIRT: CERT-Bund (Germany), determined under Art. 14(7)
This channel is scoped to Article 14: active exploitation and severe incidents. It is not a general bug-bounty or feature-request intake.
Source: Art. 3(42), Art. 14, Art. 14(7), Art. 71(2), Regulation (EU) 2024/2847.
§
Basis: Art. 14, Art. 14(7), Art. 3(42), Art. 71(2), Regulation (EU) 2024/2847 (Cyber Resilience Act) — applicable from 11 September 2026.