Terminalworks Vulnerability Disclosure Policy

If you believe you have found a security vulnerability in a Terminalworks product, please tell us. This policy covers TSPrint, TSScan, TSWebCam, UniTwain, CLPrint, CLScan, PDFPrinting.NET, TwainScanning.NET, Terminalworks.Scanning, TWTwainJS, the ASP.NET Core PDF Viewer, Alcedo RDP, and our licensing and download services.

Email [email protected] with the product and version affected, a description of the issue and its impact, steps to reproduce or a proof of concept, and how to reach you. Please do not report security issues through public forums or ordinary support tickets.

• Acknowledge your report within 3 working days.
• Give you an initial assessment within 10 working days.
• Keep you updated and tell you when a fix is released.
• Credit you in our security advisory, if you wish.
• Not take legal action or file a criminal complaint against anyone who researches and reports in good faith under this policy.

• Give us reasonable time to fix the issue before you disclose it publicly. We aim to fix within 90 days and will agree a disclosure date with you.
• Test only on installations you own or are authorised to test. Do not access, change or delete data that is not yours, and do not disrupt our services or our customers' systems.
• No social engineering, phishing or physical attacks.

Security fixes are free of charge for all supported versions. We publish advisories for fixed vulnerabilities at terminalworks.com/security/advisories, with the affected products and versions, severity, impact and how to update. Where a vulnerability is actively exploited, we notify the competent EU authorities as the EU Cyber Resilience Act requires.

Last updated: 23 October 2026