Version 1.0 — Effective from 1 November 2026
Scope
This policy covers the Fleetless console, the APIs, the realtime service, the auth portal, the bridge, the SDK, the contracts package, the app starter and the software we supply for Enterprise instances. It also covers the cloud functions of Fleetless that these components need in order to work.
How to report
If you believe you have found a security vulnerability in Fleetless, please tell us at security@fleetless.dev.
Please describe what you found, where, how to reproduce it and what an attacker could do with it. You can write in English or German.
What we do
- We confirm receipt within three working days.
- We assess the report and tell you our assessment and our plan within ten working days.
- We fix confirmed vulnerabilities as quickly as their severity requires and tell you when the fix is available.
- With your consent, we name you in the advisory.
- We do not pay rewards.
Coordinated disclosure
Please give us 90 days from your report before you publish details, or less if we have released a fix earlier. If a vulnerability is being actively exploited, we may publish information or warn affected users earlier; where possible, we will tell you before we do.
This is a request for coordinated disclosure, not an absolute obligation to stay silent. It does not restrict reports to public authorities, time-critical measures to protect users, or other disclosures that you are legally entitled or required to make.
Good-faith research
We authorise security testing within the scope and limits of this policy to the extent that we are entitled to do so. For good-faith research that stays within those limits, we will not bring civil claims or seek criminal prosecution based solely on that research. This is our commitment only; it does not bind public authorities or third parties or authorise unlawful conduct. If you are unsure whether a test is permitted, contact us before testing.
Stay within these limits:
- test only with accounts, organisations and robots that are yours or that you may use;
- do not intentionally access, change or delete other people’s data. If you come across personal data or other data that is not yours, stop at once, do not access any more of it, do not use or share it, keep only the minimum evidence needed to describe the problem, and tell us. We agree with you how to handle that evidence securely and when to delete it;
- do not degrade the service: no denial-of-service, no load tests, no spam;
- never test in a way that could move a robot unexpectedly or harm people or property;
- do not use social engineering and do not attack our staff, premises or service providers.
Vulnerabilities affecting robot safety
Testing that could endanger people or property is prohibited. Please report vulnerabilities that could cause unsafe robot behaviour using a safe description or proof of concept; do not demonstrate them on a live robot.
Out of scope
- Reports from automated scanners without a demonstrated impact.
- Missing best practices, such as individual security headers, without a concrete exploit.
- Vulnerabilities in services and software that we neither operate nor supply. If a vulnerability in a third-party component affects Fleetless, please tell us as well.
last updated 2026-11-05