Lattice Vulnerability Disclosure Policy
Effective: August 2026
Introduction
Lattice Semiconductor welcomes feedback from security researchers, customers, partners, and the general public to help improve our security. If you believe you have discovered a vulnerability, privacy issue, exposed data, or other security issue in any of our assets, we want to hear from you. This policy outlines how to report vulnerabilities to us, what we expect, and what you can expect from us.
Systems in Scope
This policy applies to Lattice products with digital elements and associated digital infrastructure.
Out of Scope
Products not manufactured or supplied by Lattice, including third-party products used in the same system as a Lattice product, are out of scope.
Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or authority.
Our Commitments
When working with us under this policy, you can expect us to:
- Respond to your report promptly and work with you to understand and validate your report;
- Strive to keep you informed about the progress of a vulnerability as it is processed, and
- Work to remediate confirmed vulnerabilities in a timely manner, within our operational constraints.
Rules of Engagement
If you participate in our vulnerability disclosure program in good faith, we ask that you:
- Follow this policy and any other applicable agreements;
- Report suspected vulnerabilities promptly through the Official Channels identified below;
- Perform testing only on systems, hardware, software installations, and accounts that you own or are explicitly authorized to test;
- Do not perform social engineering, phishing, or physical attacks against Lattice employees, contractors, offices, customers, or users;
- Do not perform denial-of-service attacks or load, stress, or resource-exhaustion testing against Lattice-operated services, production infrastructure, or other live systems;
- You may report denial-of-service or availability weaknesses in Lattice products. Testing of these conditions must be limited to hardware, software, and test environments that you own or are explicitly authorized to use;
- Avoid disrupting systems, degrading availability, destroying or modifying data, violating the privacy of others, or harming the user experience;
- If you obtain unintended access to a system, account, or data, stop at the point of recognition. Access only the minimum information necessary to demonstrate the issue. Do not attempt to determine what additional information may be accessible, and report the issue immediately;
- Interact only with test accounts that you own or accounts for which the account holder has provided explicit permission;
- If you encounter personal, health, payment card, confidential, or proprietary information, stop testing and report the issue immediately;
- Give Lattice a reasonable opportunity to investigate and address the issue before public disclosure;
- Do not sell, trade, transfer, or use information about the vulnerability for any purpose other than reporting it to and coordinating with Lattice; and
- Do not engage in extortion.
Official Channels
Please report security issues to security@latticesemi.com, providing all relevant information. The more detail you provide, the easier it will be for us to triage and fix the issue.
If you want to download this policy file as PDF, please Click Here
Encryption (PGP)
For sensitive reports, please encrypt your message using our PGP public key below.
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEapi01hYJKwYBBAHaRw8BAQdAq/oUErI87Pf39PSzkNhLjvE5g0+EsTwsNr/g 2B23DrW0WExhdHRpY2UgU2VtaWNvbmR1Y3RvciBQcm9kdWN0IFNlY3VyaXR5IElu Y2lkZW50IFJlc3BvbnNlIFRlYW0gPHNlY3VyaXR5QGxhdHRpY2VzZW1pLmNvbT6I tQQTFgoAXRYhBFX2fC/WrsrPqc4X6wXhREma35zcBQJqmLTWGxSAAAAAAAQADm1h bnUyLDIuNSsxLjEyLDIsMQIbgQUJBaSpWgULCQgHAgIiAgYVCgkICwIEFgIDAQIe BwIXgAAKCRAF4URJmt+c3Ml9APsGJUVkfOtuy9+SfGUqb4sYksZ4u5Z8IB6NoZ/5 J8FlogEA2aIhOTSrRPmI7het3lgaIhpk7zMNUWBeYgiwv+mTUw+4OARqmLTWEgor BgEEAZdVAQUBAQdAGVepSd96q/4QypnLJGZl9GYFYiBK8SRE02rnJoqp2HcDAQgH iJoEGBYKAEIWIQRV9nwv1q7Kz6nOF+sF4URJmt+c3AUCapi01hsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDECGwwFCQWkqVoACgkQBeFESZrfnNxyZAD/aKdJQVb4 lKQz13GNt6OkO1fuyOh/xeiKyM9e+AJA6VwA/Rf9n5/f7x/0dBI5kKqo67s9pXc4 4nZZvUxXO8HWGoYBuDMEapi09BYJKwYBBAHaRw8BAQdAyEzd5bQyIgPPBuLIf2wI ACUhyJWHZrinG+5PefTd4p6JAQsEGBYKADwWIQRV9nwv1q7Kz6nOF+sF4URJmt+c 3AUCapi09BsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwyLDECGwIAgQkQBeFESZrf nNx2IAQZFgoAHRYhBC3oaGeoHiz3lGI7Khf8N62y0oe0BQJqmLT0AAoJEBf8N62y 0oe06bAA/iX9JvT8y3grfL7w7lk98k0IC21BFlT34U13dyN/OhJdAQC8WPxlcx9d OfG4TdnO5akun8+KQ+zX4R0dziDaGZg/Ds7FAP9j+4kyKRXaTei1EmklCBFDlbGG s9IV9i4iDymSk10IPAD/dG46+GsAEpTcF/fL+b/8wSF/TqaCeWL/ZVDb1fAvegY= =3cQ5
-----END PGP PUBLIC KEY BLOCK-----
