Bluebird | Global leading provider of handheld computers, industrial tablets and mobile payment devices.

GO TO GNB

GO TO CONTENT

HOME About Bluebird Legal & Compliance

Legal & Compliance

Security Advisory

At Bluebird, we take security and privacy seriously. As a provider of enterprise mobility solutions—rugged handheld computers, tablets, RFID readers, and payment terminals—we are committed to earning and retaining the confidence of our customers by delivering reliable products that safeguard the privacy and security of their data.

We believe in being proactive rather than reactive toward emerging security threats. We work closely with security researchers, partners, and the wider security community to stay abreast of the latest security developments and to incorporate them into our product design throughout the entire product lifecycle.

We value the contribution of the security research community and follow the philosophy of Coordinated Vulnerability Disclosure (CVD). To protect our users, we refrain from publicly announcing security vulnerabilities until a solution has been made available, and we do not disclose technical details that could enable exploitation. Once a solution is available, we publish the relevant information through our security advisories.

We are committed to:

  • Acknowledging receipt of every vulnerability report promptly.
  • Working with the reporter to understand and resolve the reported issue as quickly as possible.
  • Making our best effort to release security updates to affected users in a timely manner.
  • Recognizing the contribution of reporters through our acknowledgements, where eligible.

Vulnerability Disclosure Policy

Policy Statement

Bluebird Inc. is committed to providing secure and reliable enterprise mobility products and services while continuously enhancing product cybersecurity resilience. To assist customers, users, security researchers, partners, and other stakeholders in reporting potential security vulnerabilities affecting our products, Bluebird has designated a Product Security Response Team (PSRT) — a cross-functional group responsible for receiving, evaluating, verifying, remediating, and disclosing product security vulnerabilities.

We adopt a Coordinated Vulnerability Disclosure (CVD) mechanism, working closely with reporters and relevant stakeholders to minimize the risk of malicious exploitation and to protect the information security of all users.

Scope of Application

This policy applies to products and services developed, maintained, or sold by Bluebird Inc. within their security-support period, including but not limited to:

  • Hardware
  • Firmware
  • Software
  • RFID modules and readers
  • Management interfaces
  • APIs and communication protocols
  • Cloud services
  • Mobile applications
  • Update and maintenance tools
  • Products integrated with third-party and open-source components

Products that have reached the end of their security support are generally excluded from this policy; however, we may still evaluate actual risks to determine whether to accept a report on a case-by-case basis.

Vulnerability Handling Process

The Company's vulnerability management process consists of the following steps:

Step 1: Receipt and Registration
A case number is generated and tracked upon receiving a vulnerability report.

Step 2: Vulnerability Verification
Confirm whether the vulnerability is reproducible and affects supported products and versions.

Step 3: Risk Assessment
Comprehensive evaluation based on:

  • CVSS severity score
  • Exploitability (attack scenario and likelihood of exploitation)
  • Security impact (scope and severity of the affected products)

to determine remediation priorities

Step 4: Remediation and Testing
Following patch development, the following procedures are executed:

  • Patch verification
  • Regression testing
  • Security testing
  • Update integrity verification
  • Ensuring that no new security risks are introduced

Step 5: Announcement and Disclosure
Publish a Security Advisory at an appropriate time, providing:

  • Vulnerability description
  • Affected products
  • Patched versions
  • Mitigation measures
  • Update instructions

Response Timeline Targets

Item Timeframe
Acknowledgment Within 2 business days
Initial Validity Assessment Within 10 business days
Severity Assessment Within 15 business days
Status Updates Provided periodically
Public Disclosure Once a patch or mitigation is available

Note: Actual timeframes may vary depending on vulnerability complexity, product impact scope, and third-party coordination requirements.

Policy Maintenance

This policy is reviewed at least annually and updated appropriately under the following circumstances:

  • Changes in regulations or standards
  • Changes in product types
  • Occurrence of major security incidents
  • Improvements needed in the vulnerability handling process

The latest version will be posted on the Company's official website.

Disclaimer: Various aspects of information security vulnerability management principles may be subject to change on a case-by-case basis. The Company does not guarantee a response to any specific inquiry or issue. Use of the information contained within this document or links provided herein is at your own risk. The Company reserves the right to modify any content within this policy at any time without prior notice. Any modifications will be published on the Company's official website.