At Metso, security is a core part of how we build and operate our products and digital services. We appreciate the work of security researchers, customers, and partners who help us identify potential vulnerabilities. If you’ve found a security issue, we want to hear from you.

If you identify a potential vulnerability in a Metso product, service, or digital asset, we encourage you to report it so we can address it as quickly as possible. Your support helps us strengthen the protection of our organization, our customers, and our systems.

You can submit your findings through the Metso Trust Center. This helps us protect sensitive information and ensures your report reaches the right team.

Please follow these guidelines when conducting research:

• Do not exploit the vulnerability or attempt destructive testing. Avoid accessing, modifying, or disclosing customer or operational data.
• If you encounter sensitive data (such as credentials or personal information), stop testing immediately and include this fact in your report.
• Do not disclose the issue publicly until Metso has coordinated remediation or mitigation and determined that public disclosure is appropriate.
• Do not conduct testing involving physical security, social engineering, denial‑of‑service, spam, or third‑party systems.
• Please include enough detail for us to reproduce the issue. A clear description, affected system, and steps to reproduce are typically sufficient, though complex issues may require additional information.

What you can expect from Metso:

• We will assess and triage your report and respond within a reasonable timeframe, requesting additional details if needed to understand or reproduce the issue.
• As long as you act in good faith and follow this policy, Metso will treat your research as authorized and will not initiate legal action.
• Your report will be handled confidentially. Technical details are shared only with personnel involved in assessing and resolving the issue, except where disclosure is required by law, regulation, or cooperation with relevant authorities.
• Public disclosure will be coordinated once remediation or mitigation is available.
• Metso may acknowledge your contribution in a Security Bulletin. If you prefer to remain anonymous, we will respect that. Metso does not offer monetary rewards or operate a bug bounty program.

Scope

Reports may be submitted for:

• Metso products and software
• Digital assets owned, operated, and maintained by Metso
• Metso‑operated websites  (e.g., metso.com, hsc-chemistry.com)  

Thank you for helping keep Metso secure.