Helisoft develops the Helios platform and its satellite integration components. If you have found a security vulnerability in our products or on this website, we want to hear from you, and we want reporting it to be simple and safe.
How to report
Email security@helisoft.se, or use the contact form if you prefer not to use email. Include what you can: product and version or URL, a description of the vulnerability and its impact, the steps to reproduce it, and any proof of concept. Tell us how you want to be credited, or that you would rather not be. Anonymous reports are welcome.
What we ask of you
Test only systems that are ours or that you are authorised to test. Helios installations run in our customers’ own environments; testing them requires their permission, not ours. Do not access or keep more data than needed to show the issue. No denial of service, no social engineering, no physical intrusion. Stop and report as soon as you have confirmed the vulnerability, and give us time to fix it before going public.
What you can expect from us
Acknowledgement within three business days. An initial assessment and a plan within ten business days, and updates while we work. Fixes and security updates to affected customers within the product’s support period. Credit in our release notes if you want it. Where a vulnerability is being actively exploited we report it to the authorities as the EU Cyber Resilience Act requires, and we inform affected customers.
Coordinated disclosure
We ask for ninety days from acknowledgement before public disclosure, earlier if a fix ships sooner, later only with an agreed date and a reason. We never ask you to stay silent indefinitely.
Safe harbour
Good-faith research within this policy is authorised by Helisoft AB. We will not take legal action against you for it, and if a third party does, we will confirm that your actions were authorised. This covers our own systems and products only.
Out of scope
Third-party services we use but do not control, findings that need physical access, missing best practices without demonstrable impact, and customer-operated installations. Unsure? Ask first.
Machine-readable contact details: helisoft.se/.well-known/security.txt
Contact information
