Skip to main content

Report a vulnerability

If you think you've found a security vulnerability in a Centro product or service, email [email protected]. Reports to this address go to the person responsible for product security, not the support queue.

Centro is made by SI Sound and Light Ltd, trading as LCD. The full policy is the LCD security policy. This page summarises it.

What to include​

  • The product and its version, for example Centro System Manager 2.14.0.
  • What the issue is and what an attacker could do with it.
  • Steps to reproduce it, with any proof-of-concept code or screenshots.
  • How you'd like to be credited, if at all.

Don't send passwords, licence keys or other people's personal data. If we need sensitive material from you, ask us for a secure way to transfer it.

What happens next​

  • We acknowledge your report within 3 working days.
  • We tell you whether we've confirmed the issue within 10 working days.
  • We update you at least every 14 days until the report is closed.
  • We aim to release a fix within 90 days of confirming the issue, and agree a publication date with you.
  • We credit you in the advisory if you'd like.

There's no paid bug bounty.

What's in scope​

Centro products and services, including Centro System Manager for Crestron, the Centro Crestron Home drivers, the Centro cloud and apps, and the centro.network websites. LCD's own products are covered by the same policy.

Issues in third-party products, such as Crestron processors, belong with that vendor. If you're not sure who owns an issue, report it to us and we'll help route it.

Testing​

  • Only test systems you own or have permission to test.
  • Stop once you've confirmed the issue. Don't view, change or keep other people's data.
  • Don't disrupt live installations, the licensing service or the websites.

Good-faith research that follows these guidelines is treated as authorised, and we won't take legal action over it.

Security updates​

Security fixes ship as normal product releases at no extra charge, and the release notes flag them.

note

For installation help, licence questions or faults that aren't security issues, use the support portal instead.