Vulnerability Disclosure

LifeFinder Systems International AB takes the security of our products seriously. If you
believe you have found a security vulnerability in a LifeFinder product, we want to hear
from you. 

This process supports our obligations under the EU Cyber Resilience Act (CRA).

How to report a vulnerability

Email security@lifefinder.se. Please include:

  • The affected product, and its version if you know it
  • A description of the vulnerability and its potential impact
  • Steps to reproduce it, or a proof of concept
  • How we can reach you for follow-up questions

You can write to us in English or Swedish. Please do not send more personal data, or more customer data, than the report needs.

Which products this covers

  • LifeFinder software, including the LifeFinder web application and its backend services
  • LifeFinder field hardware, including its firmware

The following are out of scope: denial-of-service attacks, social engineering of our staff or customers, and physical attacks against equipment.

What happens after you report

  1. We confirm that we have received your report within 5 working days.
  2. We give you our initial assessment within 15 working days.
  3. We keep you informed while we investigate and fix the issue.
  4. We tell you when a fix is available, and agree with you on when the vulnerability can be made public.
  5. With your permission, we credit you when the vulnerability is published.

Coordinated disclosure

Please give us a reasonable time to fix the vulnerability before you disclose it publicly. We ask for up to 90 days from your report, or less if the fix is released earlier. If a fix needs more time, we will explain why and agree on a new date with you.

Good-faith research

We will not take legal action against you for research that follows this policy, provided that you:

  • Only test equipment and systems that you own, or that you have permission to test.
  • LifeFinder systems are installed at our customers’ sites and on board vessels, so do not test against a customer installation.
  • Avoid accessing, changing or deleting data that is not yours, and stop as soon as you have confirmed the vulnerability.
  • Avoid disrupting services or safety functions.
  • Report the vulnerability to us promptly and keep it confidential until it has been fixed.
  • We do not currently offer a paid bug bounty.

Security advisories

When we fix a vulnerability in a LifeFinder product, we publish a short advisory here.

No advisories have been published yet.