Security
Coordinated Vulnerability Disclosure Policy
Reporting a vulnerability
If you believe you have found a security vulnerability in a CapOpt product or service, please tell us at:
We would rather hear from you than not. You do not need to be certain, and you do not need to provide a working exploit.
What helps
- What you found, and where — product, service, URL or device
- How to reproduce it, in enough detail that we can see the same thing
- What you think an attacker could do with it
- Whether you have told anyone else, and whether you intend to publish
Write in English or Swedish, whichever you prefer.
What we commit to
CapOpt AB is a three-person company. These are commitments we can actually keep, rather than the ones that read best:
| Acknowledgement | Within 3 working days |
|---|---|
| Initial assessment | Within 10 working days — whether we can reproduce it, and our view of severity |
| Updates | At least every 30 days while the report is open |
| Resolution | We will tell you when it is fixed, and what we changed |
We do not operate a bug bounty and cannot offer payment. If you would like to be credited when we publish a fix, say so and we will, unless you ask us not to.
Coordinated disclosure
We ask for 90 days from your report before public disclosure, so that a fix can be developed and deployed to installed devices.
If you want to publish sooner, tell us and we will try to agree a date. If we cannot fix it in 90 days we will tell you why and propose a longer period, but we will not use that to delay you indefinitely. If the vulnerability is already public or being exploited, disclosure timing stops being ours to ask about.
Safe harbour
If you act in good faith and follow this policy, we will not pursue legal action against you, and we will not report you to law enforcement.
If a third party brings action against you for research conducted in accordance with this policy, we will make it known that your actions were authorised.
This does not, and cannot, waive the rights of our customers or of anyone else. See the scope limits below.
Scope
In scope — products and services CapOpt AB places on the market or operates:
- The Capacity Optimizer Gateway (model CO-LB-100) and the CapOpt software running on it
- The CapOpt cloud API and dashboard
- CapOpt's public websites
Out of scope:
EV chargers, electricity meters and battery storage systems. These are made by other companies. If you find a vulnerability in one, report it to its manufacturer — we will help you find the right contact if you ask.
Customer networks and customer premises. They are not ours to authorise testing on.
Third-party services we use but do not operate.
Findings that are only reachable by first compromising something out of scope.
What we ask you not to do
Most of this is standard. The second point is not, and it matters more than the rest.
- Do not access, modify or delete data that is not yours.
- Do not test against a live installation. A CapOpt Edge controls EV chargers, battery storage and electrical load at a real site. Interfering with one can trip a site's supply, interrupt charging that someone is relying on, or damage equipment. This is a safety boundary, not a legal formality. If you need to demonstrate something against a real device, contact us first and we will arrange it.
- Do not perform denial-of-service testing, or anything that degrades availability.
- Do not use social engineering, phishing, or physical attacks against our staff or customers.
- Do not use automated scanning that generates significant load.
- Do not publish details before the disclosure period we have agreed.
When we tell customers
If a vulnerability affects deployed devices, we notify affected customers with mitigation advice before public disclosure. Where the law requires us to notify an authority — for example under the Cyber Resilience Act or the Radio Equipment Directive — we will, and doing so does not change what we have agreed with you.
Last updated: 10 September 2026