Report a Product Security Issue

Synopsys PSIRT recommends that all security reports for Synopsys products be sent encrypted using PGP. Please report potential security vulnerabilities to the PSIRT email address (psirt@synopsys.com).

For efficient handling of the issue, we recommend that the report has the following structure and content:

• Affected Product and Version
• Reporter severity score
• Technical description of the issue
• Demo evidence of the issue
• Sample code used to exploit the vulnerability
• Date/time of discovery
• Contact information and optional name for acknowledgments
• Reporter’s Public PGP Key
• Possible disclosure plans

Synopsys PSIRT encourages those individuals who report vulnerabilities to evaluate and assign an initial severity using an industry-recognized standard, such as FIRST CVSSv3.

Note: given the complexity of security issues in the hardware context, the response times from customers, and patching limitations can lead to longer embargo periods than those typically used in software industry. This time can be necessary for the customers to devise and implement mitigation strategies.