Product Security

This page describes how to report a vulnerability in a MAXAGV product and how we handle reports.

Reporting a vulnerability

To report a vulnerability in a product MAXAGV has supplied, write to security@maxagv.com. Use the same address for issues in our own IT systems, including this website. Reports can be written in English or Swedish.

Please include the affected product and version, steps to reproduce the issue, its potential impact, and your contact details.

We confirm receipt within three working days and send you our assessment within fourteen days of receipt. The assessment includes our reasoning, even when we judge a report to be of low impact.

When a fix is available, we notify affected customers and publish a description of what was resolved. Please keep details private until then, or until a date we agree with you. We credit reporters who wish to be named.

Safe harbour

MAXAGV will not take legal action against anyone who reports in good faith under this policy. Good faith means keeping details private as described above, accessing no more data than is needed to demonstrate the issue, and leaving live operations and other people’s data untouched. Testing a customer’s installation requires that customer’s permission.

For our customers

Contact your MAXAGV representative as usual. Security advisories are sent to you directly.

If you suspect that a vulnerability in your installation is being exploited, contact us as soon as possible, even before your own investigation is complete. Under EU Regulation 2024/2847, we are required to notify the authorities within 24 hours of becoming aware of an actively exploited vulnerability.