Vulnerability Disclosure Policy

Enea takes the security of our products and our customers seriously. We value the contribution of independent security researchers and welcome reports of vulnerabilities discovered in good faith. This policy describes what is in scope, how to report a vulnerability to us, and what you can expect from Enea in return.

In Scope

• Enea-owned public-facing digital assets.
• Enea software and service components released or licensed to customers, where the vulnerability can be demonstrated in a supported, publicly available version.
• Third-party and open-source components integrated into an Enea product, where Enea is required to help coordinate disclosure of vulnerabilities in the components it integrates, including with the upstream maintainer.

Out of Scope

• Customers: Please report vulnerability issues through the Customer Support Portal.
• Employees: Please report vulnerability issues through internal security reporting channels.
• Internal Enea projects and systems not intended for public access.
• Standalone third-party products or services which are not integrated into or shipped as part of an Enea product.
• Findings that require physical access, social engineering, or denial-of-service (DoS/DDoS) testing.

Enea considers security research and vulnerability disclosure activities conducted in accordance with this policy to be authorized. Enea will not pursue legal action against, or support legal action by third parties against, individuals who:

• make a good faith effort to comply with this policy.
• avoid actions that compromise privacy, destroy data, or disrupt or degrade Enea’s products or services.
• promptly report any discovered vulnerability and do not exploit it beyond what is necessary to demonstrate the issue.

If legal action is initiated by a third party against a researcher who has acted in good faith and in accordance with this policy, Enea will make it known that the researcher’s actions were conducted in compliance with this policy.

• No denial-of-service (DoS/DDoS) testing.
• No social engineering, phishing, or physical attacks against Enea staff, contractors, or customers.
• Do not access, modify, or delete data that does not belong to you; stop testing and report immediately if you encounter personal data, credentials, or other sensitive information.
• Use only the minimum access or exploitation necessary to reliably demonstrate the vulnerability.
• Comply with all applicable laws and regulations in the country from which you are testing and the country in which the systems are hosted.
• Do not publicly disclose a vulnerability before Enea has had the opportunity to investigate and remediate it (see Section 8, Confidentiality and coordinated disclosure).
• By submitting a vulnerability report to Enea through the channel set out in this policy, you accept that your report will be governed by this policy.

• Reporting channel: [email protected]. This is Enea’s single point of contact for vulnerability reports, as required by the Cyber Resilience Act.
• Anonymous reports are accepted. You are not required to provide your name, employer, or any contact details to submit a report.
• Language: Reports may be submitted in English.