Leach Co., Ltd. Officially Receives Acceptance for Vulnerability Report from IPA – Contributing to Japan's Security through Responsible Disclosure

## Leach Co., Ltd.'s Vulnerability Report Officially Accepted by IPA

Leach Co., Ltd. (Headquarters: Minato-ku, Tokyo; CEO: Takuya Tominaga) is pleased to announce that a report on potential vulnerabilities in a web service has been officially accepted through the vulnerability reporting system operated by the Information-technology Promotion Agency, Japan (IPA). Having received the 'Certificate of Acceptance for Vulnerability-Related Information' from the IPA, the company is publicizing this case as an instance of practicing 'Responsible Disclosure.'

### Understanding the Vulnerability Reporting System

The IPA's vulnerability reporting system was launched in July 2004, based on the Ministry of Economy, Trade and Industry's 'Criteria for Handling Vulnerability-Related Information in Software, etc.' It provides a mechanism for individuals who discover vulnerabilities in software or websites to safely convey information to developers and operators through the IPA. While tens of thousands of vulnerabilities have been reported since the inception, it is rare for a corporation to officially publicize its activities in this regard as an organization.

### The Significance of Responsible Disclosure

Responsible Disclosure is a method where, upon discovering a vulnerability, one first reports it privately to the developer or operator rather than disclosing it immediately. This provides time for corrections, a best practice recommended by global tech companies such as Google, Microsoft, and Apple, minimizing the risk of information being utilized by malicious attackers.

### Background of Discovery and Expertise

CEO Takuya Tominaga is a cloud infrastructure security expert, boasting 9 years of R&D experience at Toshiba Software Engineering Center and holding all 12 current AWS certifications. The vulnerability was identified following anomalies noticed while using an online container training environment.

### Significance of Corporate Vulnerability Reporting

1. **Proof of Technical Ability**: Objectively demonstrates deep knowledge of system architecture, communication protocols, and authentication mechanisms.
2. **Trust for Clients**: Proactively contributing to societal security serves as a trust factor for clients of the company's Generative AI advisory services.
3. **Societal Contribution**: By using public frameworks to properly adjust and fix vulnerabilities, the company contributes to the overall improvement of information security in Japan.

### Leach Generative AI Advisory Services

Leach offers a monthly advisory contract starting from 50,000 JPY, providing support for Generative AI adoption, security reviews of system architecture, security optimization of cloud infrastructure (AWS, GCP, Azure, Cloudflare), vulnerability advisory, and incident response support. The CEO, who holds all 12 AWS certifications, provides direct support.