Security at Fleeet: reporting a vulnerability
If you believe you have found a security vulnerability in a Fleeet product or service, please tell us. We read every report that reaches [email protected].
How to report. Email [email protected]. Write in English, Spanish or Swedish. Include what you found, where (product and version, or URL), how to reproduce it, and what impact you believe it has. Attach proof of concept if you have it. Do not send us customer data you may have encountered; describe it instead.
What is in scope. The Fleeet desktop agent, the Fleeet node software (fleeetd) that customers run on their own hardware, the Fleeet Transcoder, the Fleeet web app and API, and this website. If you are not sure whether something is in scope, report it anyway.
What is out of scope. Denial-of-service testing, social engineering of Fleeet staff or customers, physical attacks, and findings in third-party services we use unless the issue is in how Fleeet uses them.
What you can expect from us. We are a small team, and these are targets, not guarantees: we aim to acknowledge your report within two business days and to tell you within ten business days whether we have confirmed the issue and what we intend to do. Not every finding results in a change; when we decide not to act, we tell you why and close the report. We keep you informed of material changes until we close it, and we credit you in any advisory if you want us to. We do not pay bounties at this time.
Our commitment to good-faith research. If you act in good faith, avoid privacy violations, data destruction and service disruption, stop as soon as you have enough evidence to report, and give us reasonable time before disclosing, Fleeet will not itself take legal action against you for that research and will work with you on disclosure timing. This commitment covers Fleeet's own actions and systems Fleeet operates; it cannot speak for our customers, who run Fleeet software on their own hardware and in their own cloud accounts, so do not test customer-operated systems without that customer's authorisation.
Our obligations. Fleeet is a manufacturer of products with digital elements under the EU Cyber Resilience Act. Where a report shows a vulnerability being actively exploited or a severe incident affecting a Fleeet product, we report to the EU authorities and inform affected users as the law requires, and we may need your report's timestamps for that.