01Report an issue
- Sensitive?
- Send a first message without the details. We will agree a secure way to share them.
- Language
- English or Finnish.
Please give us time to fix the issue before you tell anyone else.
02What to include
A short, clear report helps us act fast. Plain text is fine.
- 01What you foundThe weakness, in one or two lines.
- 02WhereThe page, address, product or version.
- 03StepsWhat you did, in order, so we can repeat it.
- 04ImpactWhat someone could do with it, as you see it.
- 05How to reach youSo we can ask questions and tell you when it is fixed.
03What is in scope
Not sure? Ask us first at the address above.
In scope
- hardpointos.com and www.hardpointos.com
- EdgeOS, HP-FN1 and HP-FN1 Micro, in the versions you have from us under an agreement
Out of scope
- Services others run for us, such as email, hosting and code hosting. Please report those to the provider.
- Social engineering of our people
- Physical attacks on our sites or equipment
- Denial of service and load testing
- Scanner output with no impact shown
04How we respond
Four steps, from your report to the fix. Times count from the day we receive it.
- 01AcknowledgeWe tell you we have your report.Within 3 working days
- 02AssessWe check it and judge how serious it is.Within 10 working days
- 03FixWe work on a fix and keep you posted.By severity, agreed with you
- 04Tell youWe tell you when it is fixed, and agree when you can share it.Within 90 days, unless we agree otherwise
We do not run a paid bug bounty. With your permission, we thank you by name when the fix is out.
05Act in good faith
We want people who find issues to feel safe telling us. If you act in good faith and follow this page, we will treat your research as authorised, we will not take legal action against you or report you to the police for it, and we will work with you to understand and fix the issue. If someone else takes action against you for research that followed this page, we will make it known that we authorised it. This covers our systems only, not those of others.
Please do not
- Access, change or delete data that is not yours.
- Disrupt our services, or anyone else's.
- Test our people, our sites or equipment in the field.
- Tell others before the issue is fixed.
- Run automated scans that put load on our services.
If you reach data that is not yours, stop there and tell us.
06Product security
Technical security detail about our products is shared with customers under agreement, not on this site. Like the rest of the site, each point says where it stands.
Today
Works without the network
EdgeOS decides on the node. Nothing it needs sits in a cloud, and it keeps working with no outside link.
Building
Locked-down links and services
Encrypted, authenticated links between services and nodes, a closed firewall, and services that run with the least rights they need. Built, and rolling out across our nodes.
Next
Protected if captured
Protection for a node that ends up in the wrong hands: encrypted storage, verified start-up and a way to wipe it.
Today
Fixes
Security fixes reach customers under their agreement, which also sets how long a version gets them. When an issue affects you, we tell you directly, first.
07security.txt
A standard file (RFC 9116) that tells tools and people where to report. Ours is at /.well-known/security.txt. It also carries an expiry date, which we renew each time we publish the site.
Contact: mailto:security@hardpointos.com
Policy: https://www.hardpointos.com/security
Preferred-Languages: en, fi
Canonical: https://www.hardpointos.com/.well-known/security.txt