Security
Report a vulnerability to us
Have you found a vulnerability in one of our products? Then we want to know. Here we describe how to report it and what happens next.
Contact
How to contact us
- Email: security@xertified.com
- Response: Within five working days we confirm that we have received the report.
- Language: You can write in Swedish or English.
Would you like to encrypt your report? Use our PGP key. It has this fingerprint:
A491 4B82 777A FC3C 804B FDD0 F6E1 F949 234E 49B2
Our policy is also available in machine-readable form, in the file security.txt.
Scope
What you can report
You can report vulnerabilities in:
- the hardware of the Lock
- our applications for users
- the XMS server
- the xertified.com and xertified.se websites
The following are out of scope:
- other companies' products
- attacks that require the attacker to already have physical access to the equipment
- attempts to deceive our staff, known as social engineering
The process
What happens after your report
- Confirmation. Within five working days we confirm that we have received the report.
- Assessment. We reproduce the flaw and rate its severity. Then we tell you what we have found.
- Fix. We release a security update for every affected supported release. We tell you when it is done.
- Publication. We publish an advisory. You see our assessment first.
Actively exploited vulnerabilities are also reported to ENISA, under the Cyber Resilience Act.
Guidelines
What we ask of you
- Test on your own equipment, not on someone else's plant.
- Do not touch other people's data. It is enough to show that something is possible.
- Give us reasonable time before you publish anything.
- Describe how to reproduce the flaw. That helps us fix it faster.
You do not need to tell us who you are to report a vulnerability.
We have no formal programme that pays for reports, known as a bug bounty programme. But we may offer recognition or compensation. We do so when a report is of great value and you have acted in good faith.
Our own work
How we work on security in XoT
Proven encryption
The encryption comes from WireGuard, a well-known technology for encrypted connections.
Tested against attacks
Our partners penetration-test XoT. The reports are available on request under an NDA.
Your own tests
Would you like to run a penetration test or a security review of XoT? Then we agree together on how it is done.
No passwords
Every user and every device has its own digital certificate instead of a password.
Free security updates
Each long-term release gets security updates for five years. The updates are free of charge.
Report a vulnerability
Within five working days we confirm that we have received your report.