Flock can now issue CVEs for its own products—can it still be trusted?

Flock has become a CVE Numbering Authority (CNA) and can issue and rate CVEs for its own products such as automatic license plate recognition and AI cameras. Flock says that joining the more than 550 CNAs worldwide allows faster response to researcher reports; its vulnerability disclosure policy prohibits testing customer online deployments, physical attacks, and DoS, and there is no paid bug bounty. Katie Moussouris of Luta Security cautions that vendor self-assessment is like grading one's own homework, and credibility depends on whether records accurately identify affected versions and fixes.