Responsible disclosure, acknowledged.
We take security seriously and welcome reports from independent researchers. This page lays out scope, SLAs, contacts, and the coordinated-disclosure process we follow.
- Contact
- security@
- PGP key
- Available
- Ack
- ≤24 h
- Patch SLA
- 30/90/180 d
- Disclosure
- Coordinated
- Credit
- Public
One inbox. A human reads every email.
Email security@joulepoint.com with a clear description, reproduction steps, and the affected system. PGP-encrypted reports welcome.
Send to security@joulepoint.com. Use PGP for sensitive details — key fingerprint is published in our security.txt.
- Description and impact
- Reproduction steps
- Affected system / endpoint / firmware version
- Any proof-of-concept (please don't share publicly)
security.txt
We publish a machine-readable security policy at the standard location (RFC 9116).
What you can expect from us.
Business days. A human responds.
CVSS-aligned severity assigned with rationale.
Critical / High / Medium severity respectively.
Coordinated. We credit you on the advisory.
Test in good faith. We'll do the same.
Coordinated disclosure protects users and gives us the time to ship a real fix. Stick to these and we'll work with you, not against you.
- Act in good faith, avoid privacy violations, and never destroy or modify data.
- Do not access data beyond the minimum required to demonstrate the issue.
- Give us reasonable time to investigate and remediate before any public disclosure.
- Stay within the scope listed below. If you're unsure, ask before testing.
What's in scope. What isn't.
In scope
- joulepoint.com and *.joulepoint.com
- Joulepoint CSMS APIs (REST and WebSocket / OCPP transport)
- Joulepoint hardware firmware (DC chargers, AC chargers, VCU/ECU/CCU, OBC, DC-DC, traction)
- Joulepoint mobile apps (driver, operator, OEM)
- Cryptographic implementations (TLS, OCPP Security Profile 3, OCMF, ISO 15118-20 PnC)
Out of scope
- Third-party services we integrate with (Sanity, Vercel, AWS, etc.) — please report to those vendors directly
- Social-engineering attacks against employees or customers
- Physical attacks against our facilities
- Denial-of-service tests against production systems
- Findings from automated scanners with no demonstrated impact
Found something? Let us know.
security@joulepoint.com — acknowledged within 24 hours. PGP key in security.txt.
security@joulepoint.com