Security Incident Response and Vulnerability Disclosure Policy

Effective Date: April 6, 2026

1. Purpose

GemBox Ltd. is committed to responding quickly and responsibly to security incidents and reported vulnerabilities affecting its products, website, internal systems, or related business operations.

This page explains how security issues can be reported, how GemBox handles reported or suspected security issues, and who is responsible for coordinating the response.

2. Scope

This policy applies to all GemBox products, including all .NET and JavaScript software components distributed by GemBox.

This policy also applies to the public website www.gemboxsoftware.com, internal company accounts and employee and contractor devices (whether owned by Gembox or the individual), code repositories, build and release systems, and related business systems relevant to the security of GemBox products or operations.

Product issues and bugs that are not security-related should be reported to technical support:
https://support.gemboxsoftware.com/new-ticket

3. What is a security incident or vulnerability?

A security incident or vulnerability is any event, weakness, or activity that may negatively affect the confidentiality, integrity, or availability of GemBox products, systems, or data.

Examples include:

• A vulnerability in a GemBox .NET or JavaScript component that could be exploited.
• Unauthorized access to a company account, device, code repository, or internal document.
• Malware, ransomware, phishing, credential theft, or suspicious login activity.
• Defacement, compromise, or unauthorized modification of the public website.
• Accidental disclosure, loss, or unauthorized modification of business or customer information.
• A serious outage or third-party security event that materially affects GemBox products or operations.

4. How to report a security issue

Security incidents or suspected vulnerabilities may be reported by email to:

Please use a clear subject line such as:

• Security Incident Report
• Vulnerability Report

To help GemBox analyze the report quickly, please include where possible:

• affected product name and version
• affected platform or environment
• description of the issue
• reproduction steps or proof of concept
• potential impact
• whether exploitation is known or suspected
• your contact details for follow-up

5. Coordinated vulnerability disclosure

GemBox follows a coordinated vulnerability disclosure approach.

After becoming aware of a reported or suspected vulnerability, GemBox will review the issue, assess whether it is security-related, determine severity and scope, and decide on appropriate containment, remediation, and communication steps.

Where appropriate, GemBox will coordinate with the reporter regarding validation, remediation timing, and later public communication.

GemBox asks that reporters act in good faith and avoid actions that would unnecessarily disrupt services, harm customers, or access, modify, or disclose data beyond what is necessary to demonstrate the issue.

6. Initial response

After becoming aware of a reported or suspected incident or vulnerability, GemBox will:

• Record the issue and the time when GemBox became aware of it.
• Assess whether the issue is a security incident or vulnerability.
• Determine the affected product, version, service, account, system, or supplier.
• Assign response actions and priority based on risk and potential impact.
• Take reasonable containment measures where needed, such as revoking credentials, restricting access, disabling affected processes, or temporarily suspending release or distribution activity.

7. Early analysis and triage

GemBox will analyze the issue as early as reasonably possible.

This analysis may include:

• Determining whether the issue affects a GemBox product in scope.
• Determining whether the issue is a vulnerability, a security incident, both, or neither.
• Assessing whether exploitation is active, suspected, or not known.
• Assessing the potential effect on product security, business operations, customers, or downstream users.
• Determining whether immediate containment or customer communication is needed.

Where complete information is not yet available, GemBox will make an initial good-faith assessment based on the information available at the time and will refine that assessment during the investigation.

8. Investigation and remediation

Depending on the incident or vulnerability, GemBox may:

• Analyze logs, code, systems, repositories, dependencies, and affected components.
• Coordinate with relevant employees, contractors, or third-party service providers.
• Prepare and release a fix, workaround, mitigation, configuration change, or customer guidance.
• Document the root cause, impact, affected versions, and corrective actions.

Where a third-party service provider or dependency is involved, GemBox may coordinate with that provider while remaining responsible for handling the issue as it affects GemBox products and operations.

9. Communication and regulatory reporting

If an incident or vulnerability materially affects customers, GemBox will provide reasonable notice and guidance through appropriate channels, such as email, support communication, release notes, or website announcements.

Where required by applicable law, GemBox will make mandatory regulatory notifications.

Where a reported or discovered issue falls under a mandatory reporting obligation with a defined legal timeline, GemBox will follow that timeline and maintain a process intended to support timely reporting.

10. Responsibility

Josip Kremenic, a director and co-owner of GemBox Ltd., is responsible for coordinating security incident response and making final decisions.

If Josip Kremenic is unavailable, Marko Kozlina will act as backup coordinator and decision-maker.

Specific technical, operational, communication, or remediation tasks may be delegated to employees or independent contractors as needed.

11. Security notices and published incidents

Published security notices and incident updates, if any, will be listed at:

https://www.gemboxsoftware.com/company/security-incidents

12. Review and updates

This policy will be reviewed periodically and updated when needed to reflect changes in products, operations, legal requirements, or security risks.