Responsible disclosure
If you've found a vulnerability in something Clevo has built or runs, we want to hear about it. We take reports seriously and handle them quickly.
01 / Guidelines
How to report
How to report
Email hei@clevo.no with:
- What you found and where (URL, endpoint or app)
- Steps to reproduce
- Potential impact
- How we can reach you
In scope
clevo.no and its subdomains, and the products FleetVakt, Potepass and Potten.
- Out of scope: denial of service, social engineering, physical attacks and third-party services we don't operate
What we ask
- Don't access, modify or delete other people's data beyond what's needed to demonstrate the issue
- Don't disclose publicly until we've fixed it, or 90 days have passed
- Stop and tell us if you come across personal data
Safe harbour
We won't report you to the police or take legal action for research carried out in good faith under these guidelines. We're happy to credit you publicly if you'd like.
What to expect
We acknowledge receipt within 3 business days, give an initial assessment and keep you updated until the issue is fixed.
For security professionals
Security professionals can also find our contact details in security.txt.