At OBDeleven, security is a fundamental element of our products, services and business operations. As a provider of connected automotive diagnostic solutions, mobile applications, cloud services and vehicle communication technologies, we recognize that maintaining the confidentiality, integrity, availability and resilience of our systems is essential for protecting our customers, partners, employees and the wider automotive ecosystem. 

Cybersecurity is a shared responsibility. While OBDeleven continuously invests in secure software development practices, vulnerability management, infrastructure monitoring, penetration testing and continuous security improvements, independent security researchers also play an important role in identifying vulnerabilities that may otherwise remain undiscovered. 

OBDeleven values the work performed by the global cybersecurity research community. Responsible vulnerability reporting contributes significantly to improving the security of digital products and services by enabling organizations to identify, assess, remediate and disclose security vulnerabilities before they can be maliciously exploited. 

This Vulnerability Disclosure Policy (the Policy) establishes a structured process through which security researchers may responsibly report suspected security vulnerabilities affecting OBDeleven products and services. It also explains how OBDeleven receives, validates, investigates, remediates and coordinates the disclosure of reported vulnerabilities. 

The purpose of this Policy is not only to facilitate effective communication between OBDeleven and security researchers but also to establish clear expectations for responsible security research. By defining mutual responsibilities, reporting procedures, communication channels and disclosure principles, this Policy seeks to foster a transparent, collaborative and constructive relationship between OBDeleven and the security research community. 

This Policy has been developed in accordance with internationally recognized cybersecurity practices and is aligned with the principles of Coordinated Vulnerability Disclosure (CVD) promoted by the European Union Agency for Cybersecurity (ENISA), the NIS Cooperation Group Guidelines on Coordinated Vulnerability Disclosure, ISO/IEC 29147 (Vulnerability Disclosure), ISO/IEC 30111 (Vulnerability Handling Processes) and other recognized cybersecurity standards and best practices. 

The primary purpose of this Policy is to establish a clear, transparent and responsible framework for reporting and handling security vulnerabilities affecting OBDeleven products, services and supporting infrastructure. 

Through this Policy, OBDeleven aims to encourage the responsible disclosure of vulnerabilities while minimizing potential risks to customers, business operations and third parties. Early identification and remediation of vulnerabilities are essential components of an effective cybersecurity risk management program and contribute to the resilience of connected automotive technologies. 

Specifically, this Policy seeks to: 

This Policy does not constitute a bug bounty program and should not be interpreted as creating any contractual entitlement to financial compensation or other rewards. Any recognition offered by OBDeleven for reported vulnerabilities remains entirely at the discretion of the company and will be described separately where applicable. 

The objectives of this Policy are to establish a coordinated vulnerability disclosure process that enables security vulnerabilities to be identified, assessed, remediated and disclosed in a manner that protects customers, supports responsible security research and minimizes cybersecurity risk. 

In pursuing these objectives, OBDeleven is committed to the following principles: 

The protection of our customers remains our highest priority. Vulnerability handling activities should always seek to reduce the likelihood of unauthorized access, data compromise, service disruption, or other adverse impacts on customers using OBDeleven products and services. 

Security vulnerabilities should be disclosed responsibly through a coordinated process that provides sufficient time for investigation, validation, remediation, testing and customer communication before public disclosure. 

OBDeleven seeks to establish a constructive and professional relationship with the cybersecurity research community. Effective vulnerability management relies upon timely, respectful and transparent communication between researchers and vendors. 

Researchers should understand how vulnerability reports are handled, what information is required, what communication they can expect and how disclosure decisions are made. 

Security testing should always be proportionate to its objective. Researchers should employ the least intrusive testing methods necessary to demonstrate the existence of a vulnerability while minimizing any potential impact on systems, services, or customer information. 

Information relating to reported vulnerabilities should remain confidential throughout the investigation and remediation process unless coordinated disclosure has been agreed or disclosure is otherwise required by applicable law. 

Every confirmed vulnerability represents an opportunity to improve the security of OBDeleven products, development processes, operational procedures and cybersecurity governance. Lessons learned through vulnerability handling activities contribute to strengthening the organization's overall security posture. 

This Policy applies to security vulnerabilities affecting information systems, software, hardware, cloud services and digital assets that are owned, developed, operated, or managed by OBDeleven. 

The scope has been defined to provide researchers with clarity regarding which systems may be tested under this Policy and to ensure that security research is conducted in an authorized and controlled manner. 

Unless otherwise stated, the following categories of assets are considered in scope. 

This Policy applies to websites owned and operated by OBDeleven, including official corporate websites, customer portals, account management interfaces, documentation websites, support platforms and other publicly accessible web services operated under OBDeleven-controlled domains. 

Testing should be limited to vulnerabilities affecting the security of the application or supporting infrastructure and should avoid unnecessary interaction with customer accounts or personal information. 

The Policy applies to official OBDeleven mobile applications distributed through authorized application stores, including Android and iOS applications, together with associated application programming interfaces (APIs), authentication mechanisms and backend services supporting those applications. 

Researchers are encouraged to evaluate the security of mobile applications using non-production accounts whenever possible. 

This Policy applies to cloud-hosted services operated by or on behalf of OBDeleven, including customer account services, authentication services, data processing services, cloud APIs, backend infrastructure and other hosted environments supporting OBDeleven products. 

Testing activities must avoid degrading the availability or performance of production environments. 

OBDeleven develops products that communicate with supported vehicles through diagnostic interfaces and cloud-connected services. 

Research involving connected vehicle functionality must be conducted in a controlled environment using vehicles, devices and equipment that the researcher is authorized to access. Under no circumstances should testing create risks to road users, vehicle safety, or third-party property. 

Researchers must never conduct testing on vehicles while they are in operation or otherwise compromise the safety, reliability, or lawful operation of a vehicle. 

This Policy applies to official OBDeleven hardware devices, including diagnostic adapters, communication modules, firmware and supporting software components developed or distributed by OBDeleven. 

Testing involving firmware modifications should be conducted responsibly and should not interfere with production infrastructure or services. 

 

Official APIs developed and operated by OBDeleven are within the scope of this Policy, including authenticated and unauthenticated interfaces intended for customer use or integration with supported services. 

Researchers should limit requests to those necessary to demonstrate a vulnerability and should avoid excessive automated requests that could affect service availability. 

Where vulnerabilities relate directly to infrastructure operated by OBDeleven, including authentication systems, identity management services, networking components, cloud infrastructure, logging services, or administrative interfaces, such vulnerabilities may also fall within the scope of this Policy, provided testing complies with all requirements set forth herein. 

Certain OBDeleven products and services rely upon third-party technologies, cloud providers, open-source software, payment processors, analytics platforms, communication services, or other externally managed systems. 

Unless OBDeleven expressly authorizes otherwise, third-party systems that are not owned or operated by OBDeleven are outside the scope of this Policy. 

If a researcher believes that a vulnerability affecting a third-party component also impacts OBDeleven products or services, the vulnerability should be reported to OBDeleven. Where appropriate, OBDeleven will coordinate disclosure with the affected third party in accordance with established coordinated vulnerability disclosure practices. This approach reflects ENISA's recommendation that vendors support multi-party coordination where upstream or downstream dependencies are affected. 

OBDeleven recognizes that independent security research is an important component of modern cybersecurity and contributes significantly to the identification and remediation of vulnerabilities before they can be maliciously exploited. We therefore encourage responsible security research conducted in good faith and in accordance with this Policy. 

For the purposes of this Policy, good faith security research means security testing undertaken solely for the purpose of identifying, verifying and responsibly reporting vulnerabilities affecting products, services, systems, or infrastructure owned or operated by OBDeleven. Such research must be performed with the intention of improving security and without any intention to exploit identified vulnerabilities for personal benefit, commercial advantage, competitive gain, or malicious purposes. 

Good faith research requires that security testing be conducted responsibly, ethically and proportionately. Researchers are expected to respect the security and privacy of OBDeleven customers, employees, partners and third parties throughout the research process. Any interaction with production systems should be limited to what is reasonably necessary to verify the existence of a suspected vulnerability. 

Researchers conducting security testing under this Policy should: 

Good faith research does not include activities intended to obtain unauthorized financial benefit, gain access to confidential business information, disrupt services, compromise customer accounts, interfere with vehicle operation, or otherwise cause harm to OBDeleven or any third party. 

Researchers should recognize that vulnerabilities may exist within complex systems involving customers, suppliers, cloud providers, open-source software and other third parties. Research should therefore be conducted with particular care to avoid unintended impacts on organizations beyond OBDeleven. 

OBDeleven appreciates that independent researchers often invest significant time and expertise in identifying security issues. This Policy seeks to provide a predictable framework that encourages constructive collaboration while protecting customers and maintaining the security and stability of production services. 

OBDeleven is committed to fostering a constructive relationship with the cybersecurity research community. We recognize that responsible vulnerability disclosure depends upon researchers having confidence that legitimate security research conducted in accordance with published rules will be treated appropriately. 

Accordingly, subject to compliance with this Policy, OBDeleven considers security testing performed within the defined scope of this Policy to constitute authorized security research. 

Where researchers conduct their activities in accordance with this Policy, OBDeleven will not intentionally initiate civil legal proceedings solely on the basis of security research undertaken pursuant to this Policy. Furthermore, where appropriate and legally permissible, OBDeleven may communicate to relevant authorities or third parties that the research was conducted under an authorized vulnerability disclosure process. 

This Safe Harbor applies only where researchers: 

The Safe Harbor does not extend to activities that: 

Nothing in this Policy authorizes activities that exceed the limits established herein. Researchers remain responsible for ensuring that their activities comply with all applicable laws and regulations within the jurisdictions in which they operate. 

Similarly, nothing in this Policy obliges OBDeleven to waive any legal rights with respect to activities that fall outside the scope of authorized security research or that demonstrate malicious intent. 

Security research conducted under this Policy should always seek to minimize operational impact while obtaining sufficient technical evidence to enable OBDeleven to reproduce and remediate the reported vulnerability. 

Researchers are expected to apply the principle of least intrusive testing, meaning that testing activities should be carefully planned to reduce risks to production systems, customer data, connected vehicles and supporting infrastructure. 

Researchers should use the minimum level of interaction necessary to verify the existence of a vulnerability. 

If a vulnerability has been successfully demonstrated using a limited proof of concept, researchers should not continue attempting additional exploitation merely to obtain further evidence. 

Examples include: 

Researchers should always ask themselves whether an additional testing step is necessary to prove the vulnerability. If the answer is no, the activity should not be performed. 

OBDeleven provides products and services used by customers in daily vehicle diagnostics and related operations. The availability of these services is therefore an important security objective. 

Researchers must avoid any activity that could reasonably be expected to interrupt, degrade, overload, or otherwise negatively affect the availability or performance of production services. 

Examples include: 

Where there is uncertainty regarding whether a proposed testing methodology may affect service availability, researchers should contact OBDeleven before proceeding. 

Researchers should avoid accessing confidential information whenever reasonably possible. 

If confidential information is encountered unintentionally, researchers should: 

Researchers must not publicly disclose, publish, or otherwise use confidential information obtained during testing. 

Researchers should use their own accounts whenever authentication is required. 

Researchers must not intentionally access customer accounts, employee accounts, partner environments, or supplier systems unless explicit authorization has been obtained from the account owner or from OBDeleven. 

Where account takeover vulnerabilities are suspected, researchers should limit testing to accounts they own or have been expressly authorized to use. 

Given the nature of OBDeleven products, particular care must be taken when conducting security research involving vehicle communication. 

Researchers must never perform testing that could: 

Security testing involving vehicles should be performed only under controlled conditions using vehicles and equipment that the researcher is authorized to access. 

To protect customers, production systems, employees and third parties, certain activities are expressly prohibited under this Policy. 

The following list is intended to provide clarity regarding activities that fall outside authorized security research. It is not exhaustive and OBDeleven may determine that other activities are similarly inconsistent with the principles of this Policy. 

Researchers must not: 

Researchers must not conduct testing against suppliers, cloud providers, payment processors, telecommunications providers, or other third-party organizations solely because they provide services to OBDeleven. 

Any vulnerabilities affecting third-party products should be reported to OBDeleven where they impact OBDeleven services. OBDeleven will coordinate with the relevant vendor as appropriate. 

Researchers must never: 

Such conduct is fundamentally incompatible with responsible vulnerability disclosure and may result in legal action. 

Researchers must never intentionally compromise the safe operation of vehicles or create situations that could endanger human life. 

Any vulnerability that presents an immediate safety risk should be reported to OBDeleven without delay and researchers should refrain from further testing unless expressly requested by OBDeleven. 

Coordinated Vulnerability Disclosure is founded on mutual trust, responsible communication and the timely exchange of information between security researchers and affected organizations. Maintaining confidentiality throughout the vulnerability handling process is essential to reducing the risk that a reported vulnerability may be exploited before appropriate mitigations or corrective measures have been implemented. 

Accordingly, both OBDeleven and researchers are expected to treat information relating to newly discovered vulnerabilities as confidential until a coordinated disclosure strategy has been agreed or public disclosure is otherwise considered appropriate. 

Confidentiality serves several important objectives, including: 

Nothing in this Policy is intended to discourage responsible academic research or legitimate public discussion of cybersecurity issues. Rather, it establishes a process through which vulnerability-specific information can be communicated in a manner that balances transparency with customer protection. 

Researchers submitting Vulnerability Reports under this Policy are expected to maintain the confidentiality of all information relating to the reported vulnerability until coordinated disclosure has been agreed with OBDeleven. 

In particular, researchers should refrain from: 

Where a researcher believes that public disclosure should occur sooner than originally anticipated, they are encouraged to discuss the matter with OBDeleven before taking any action. OBDeleven is committed to maintaining an open dialogue regarding disclosure timelines and will seek to reach a mutually acceptable outcome wherever reasonably possible. 

OBDeleven recognizes that researchers often wish to remain anonymous or otherwise protect their identity. 

Unless the researcher has expressly consented, OBDeleven will not intentionally disclose: 

 

Information provided by researchers will be shared internally only with those personnel, contractors, or trusted third parties who require access for the purposes of investigating, validating, remediating, coordinating, or managing the reported vulnerability. 

Where coordination with suppliers, software vendors, cloud providers, component manufacturers, or national Computer Security Incident Response Teams (CSIRTs) is necessary, OBDeleven may share relevant technical information on a need-to-know basis while taking reasonable measures to preserve confidentiality. 

OBDeleven believes that public disclosure of vulnerabilities contributes to improving cybersecurity by increasing transparency, encouraging remediation and enabling customers to make informed decisions regarding risk. 

However, disclosure should occur only after careful consideration of several factors, including: 

Researchers are encouraged to coordinate publication with OBDeleven wherever reasonably possible. 

OBDeleven is committed to protecting personal data and respecting the privacy rights of customers, employees, business partners and researchers. 

Security research conducted under this Policy should always be designed to minimize any interaction with personal data. Researchers should avoid intentionally accessing, collecting, processing, or retaining personal data unless such access is unavoidable for the sole purpose of demonstrating a vulnerability. 

The existence of personal data within a system does not authorize unrestricted access to that information. 

Researchers should adhere to the principle of data minimization throughout the testing process. 

Where personal data is encountered unintentionally, researchers should: 

Examples of appropriate evidence include: 

 

Researchers should avoid retaining copies of production databases, customer files, authentication credentials, or other information that is not strictly required to support the Vulnerability Report. 

If personal data is accessed unintentionally during security research, the researcher should notify OBDeleven as part of the Vulnerability Report and provide sufficient information to enable an appropriate assessment of the incident. 

Researchers should not: 

OBDeleven may request additional information where necessary to assess any associated privacy risks or regulatory obligations. 

Information provided by researchers during the reporting process will be processed solely for the purposes of: 

Further information regarding the processing of personal data is available in the OBDeleven Privacy Policy. 

OBDeleven encourages researchers to submit Vulnerability Reports through the official reporting channels published on the OBDeleven website. 

The reporting channel is: 

Email: [email protected] 

Where additional secure reporting mechanisms are made available, researchers are encouraged to use the method most appropriate to the sensitivity of the information being transmitted. 

Researchers reporting vulnerabilities that include sensitive technical information, proof-of-concept code, credentials, memory dumps, or other confidential materials are strongly encouraged to encrypt their communications. 

OBDeleven intends to publish a public PGP key to facilitate encrypted reporting. Information regarding the public key will be made available through the official website and the organization's security.txt file. 

Where encrypted communications are used, researchers should include sufficient contact information to enable OBDeleven to respond securely. 

Supporting documentation such as screenshots, logs, packet captures, source code snippets, or proof-of-concept demonstrations should be transmitted using secure methods. 

Researchers should ensure that submitted materials do not unnecessarily expose customer information, authentication credentials, cryptographic secrets, or unrelated confidential information. 

Researchers who believe they have identified a security vulnerability affecting an OBDeleven product or service are encouraged to report the issue as soon as reasonably practicable. 

Prompt reporting enables OBDeleven to begin technical validation, assess potential customer impact, coordinate remediation activities and reduce the risk of malicious exploitation. 

Researchers are not expected to perform extensive exploitation before submitting a report. In many cases, demonstrating the existence of a vulnerability is sufficient. 

OBDeleven aims to acknowledge receipt of Vulnerability Reports within 3 (three) business days. 

Acknowledgement confirms only that the report has been received. It should not be interpreted as confirmation that the reported issue constitutes a security vulnerability. 

Following acknowledgement, the Information Security team will review the submitted information to determine whether: 

Where additional information is required, researchers may be contacted to provide clarification or supplementary evidence. 

OBDeleven values open and respectful communication with researchers. 

Throughout the investigation process, researchers may receive updates regarding: 

While specific technical details or internal decision-making processes may not always be disclosed, OBDeleven will seek to provide meaningful status updates whenever reasonably possible. 

To facilitate efficient assessment and remediation, Vulnerability Reports should include, where available: 

 

Where known, researchers are encouraged, but not required, to include: 

Researchers are not expected to provide a complete security analysis before submitting a report. Reports submitted with partial information are welcome where they contain sufficient evidence to enable technical investigation. 

Researchers should also indicate: 

Providing comprehensive information significantly improves the efficiency of the vulnerability handling process and helps reduce the need for additional clarification requests. 

OBDeleven maintains a structured Vulnerability Handling Process designed to ensure that reported vulnerabilities are assessed, prioritized, remediated, and disclosed in a consistent, transparent, and risk-based manner. 

Each Vulnerability Report received under this Policy is evaluated individually. While the process followed may vary depending on the nature and complexity of the reported issue, OBDeleven seeks to apply consistent principles to all reports, including fairness, transparency, proportionality, and timely communication. 

The objectives of the Vulnerability Handling Process are to: 

Upon receipt of a Vulnerability Report, OBDeleven will perform an initial administrative review to verify that: 

Where the report contains insufficient information to enable validation, OBDeleven may request additional technical details or clarification from the researcher. 

The Information Security team will review the submitted information to determine whether the reported behavior constitutes a legitimate security vulnerability. 

Validation activities may include: 

Reports that cannot be reproduced are not automatically considered invalid. OBDeleven may work collaboratively with the researcher to clarify reproduction steps or obtain additional information. 

Where multiple researchers independently report the same vulnerability, OBDeleven generally recognizes the first report that provided sufficient information to enable validation. 

Subsequent duplicate reports remain valuable and may assist in confirming technical details or identifying additional impacts. However, duplicate reports do not necessarily result in separate public acknowledgements or recognition. 

If a report concerns systems, products, or services that fall outside the scope of this Policy, OBDeleven will, where reasonably practicable, inform the researcher accordingly. 

Where the reported issue affects a third-party supplier but also has implications for OBDeleven products or services, OBDeleven may coordinate with the relevant supplier in accordance with coordinated vulnerability disclosure principles. 

Confirmed vulnerabilities are assessed using a risk-based approach that considers both technical severity and potential business impact. 

Factors considered during assessment may include: 

Where appropriate, OBDeleven may use the Common Vulnerability Scoring System (CVSS) as one input to the overall assessment. CVSS scores are intended to support consistent severity classification but do not replace professional judgement or business context. 

As OBDeleven develops products that interact with vehicle diagnostic systems, certain vulnerabilities may have implications beyond traditional information security. 

Where applicable, vulnerability assessments may also consider: 

Once a vulnerability has been confirmed, OBDeleven will determine the most appropriate remediation strategy. 

Remediation activities may include: 

Before deployment, corrective measures are generally subject to appropriate quality assurance and security testing to reduce the risk of introducing unintended defects. 

OBDeleven recognizes that some vulnerabilities require coordination across multiple products, development teams, suppliers, or release cycles. Consequently, remediation timelines may vary depending on technical complexity, product architecture, and operational considerations. 

OBDeleven values constructive communication throughout the vulnerability handling process. 

Researchers should expect periodic updates regarding the status of confirmed reports, particularly where remediation activities require extended timeframes. 

While certain information may remain confidential for security or legal reasons, OBDeleven will endeavour to provide meaningful progress updates at appropriate intervals. 

Where circumstances materially affect anticipated disclosure timelines, researchers will be informed where reasonably practicable. 

OBDeleven supports Coordinated Vulnerability Disclosure (CVD) as the preferred mechanism for communicating security vulnerabilities. 

Coordinated disclosure seeks to balance transparency with customer protection by ensuring that affected parties have an opportunity to investigate, remediate, and deploy appropriate security updates before detailed technical information becomes publicly available. 

Both OBDeleven and researchers share responsibility for ensuring that disclosure occurs responsibly and in a manner that minimizes unnecessary cybersecurity risks. 

There is no universally applicable disclosure timeline suitable for every vulnerability. 

Disclosure decisions may consider: 

While many vulnerabilities may be suitable for disclosure within approximately ninety (90) days, certain vulnerabilities may justify shorter or longer coordination periods. 

Modern software products frequently incorporate third-party software, cloud services, open-source components, communication libraries, hardware platforms, and external suppliers. 

Where vulnerabilities affect multiple organizations, OBDeleven may coordinate with: 

Such coordination seeks to ensure that remediation activities occur in an orderly and responsible manner across the affected ecosystem. 

Where appropriate, OBDeleven may publish security advisories describing confirmed vulnerabilities. 

Security advisories may include: 

Researchers who wish to receive public recognition may be acknowledged in security advisories, subject to their consent. 

Where credible evidence indicates that a vulnerability is being actively exploited, OBDeleven may accelerate disclosure or customer notification to reduce the risk of harm. 

In such circumstances, customer protection may require deviation from ordinary disclosure timelines. 

OBDeleven values the contributions made by the global security research community. 

Subject to compliance with this Policy, researchers may be acknowledged through: 

At the time of publication, OBDeleven does not operate a financial bug bounty programme unless expressly stated otherwise on the official website. 

This Policy authorizes only those security research activities expressly described herein. 

Nothing in this Policy authorizes: 

Researchers remain solely responsible for ensuring that their activities comply with all applicable legal and regulatory requirements. 

Nothing in this Policy shall be interpreted as limiting any legal rights available to OBDeleven with respect to activities conducted outside the scope of authorized security research. 

This Policy is owned by the OBDeleven Information Security function and is reviewed periodically to ensure continued alignment with: 

OBDeleven may amend this Policy at any time without prior notice. The latest version will always be published on the official OBDeleven website. 

Security vulnerabilities should be reported through the official reporting channels published by OBDeleven. 

Email: [email protected]