Flock can now issue CVEs for its own products. Should we trust it?

Flock, a public-safety company that builds ALPRs and AI cameras, received CVE Numbering Authority (CNA) status, allowing it to assign CVE IDs and publish vulnerability advisories for its products. The article outlines concerns from researchers and security experts about conflicts of interest, Flock’s restrictive disclosure policy (which bans testing on live customer deployments and physical attacks), past reported defects requiring physical access, and the potential for the company to withhold or downplay vulnerability information given its law-enforcement customer base.