Coordinated Vulnerability Disclosure Policy

H2L Robotics B.V.  · Referenced by security.txt

1. Our commitment

H2L Robotics B.V. takes the security of its products seriously. We welcome reports from security researchers and users who identify potential vulnerabilities in our products and services, and we are committed to investigating and resolving them. This policy explains how to report a vulnerability to us, what you can expect from us, and the conditions under which we treat your research as authorized.

2. Scope

In scope:

• Products with digital elements made by H2L Robotics — the H2L Selector and H2L Potato machines — autonomous agricultural machines that identify and treat crops in the field — their firmware, and the connected services and cloud backend that support them.
• H2L Robotics-operated domains and endpoints — the websites and application programming interfaces (APIs) used by those products. These include h2lrobotics.com and its subdomains.

Out of scope:

• Third-party services and platforms H2L Robotics does not operate.
• Findings without a realistic security impact (e.g. missing best-practice headers with no demonstrable exploit, theoretical issues).
• Volumetric denial-of-service, physical attacks, and social engineering of H2L Robotics staff, customers or suppliers.
• Reports generated solely by automated scanners without validation.

3. How to report

Email security@h2lrobotics.com (see our security.txt). For sensitive details, encrypt your report with our OpenPGP public key, published at the Encryption URL listed in our security.txt.

Please include where you can:

• The affected product, service, and version or firmware level.
• A clear description of the issue and its potential impact.
• Step-by-step reproduction instructions or a proof-of-concept.
• How you would like to be credited, or whether you prefer to remain anonymous.

We can correspond in English or Dutch.

H2L Robotics does not operate a bug bounty program and does not offer monetary rewards for vulnerability reports. We recognize researchers through public credit, with your consent.

4. Safe harbor for good-faith research

If you make a good-faith effort to comply with this policy during your research, H2L Robotics will consider your activity authorized, will not pursue or support legal action against you, and will work with you to understand and resolve the issue quickly. If legal action is initiated by a third party against you for activity conducted under this policy, we will make this authorization known.

5. Guidelines for researchers

• Act in good faith and avoid privacy violations, data destruction, and disruption of our services.
• Access only the minimum data needed to demonstrate the issue; do not download, retain, or share others’ data.
• Do not exploit the vulnerability beyond what is necessary to confirm it.
• Give us a reasonable opportunity to remediate before disclosing publicly and coordinate the timing of any disclosure with us.
• Do not use the finding for any purpose other than reporting it to H2L Robotics.

6. What you can expect from us

• Acknowledgment — we aim to confirm receipt within 3 business days.
• Validation & updates — we will triage and validate the report and keep you informed of progress.
• Remediation — we will prioritize a fix according to severity and work to resolve confirmed issues promptly.
• Coordinated disclosure — we will agree the timing of any public disclosure with you; our default coordination window is 90 days from acknowledgment, which we can adjust by mutual agreement.
• Credit — with your consent, we will credit you for the discovery; we will respect a request to remain anonymous.

7. Relationship with regulatory reporting

Separately from this policy, the European Union Cyber Resilience Act requires H2L Robotics to notify the authorities (the National Cyber Security Centre of the Netherlands (NCSC-NL) and the European Union Agency for Cybersecurity (ENISA)) of actively exploited vulnerabilities and severe incidents. Submitting a report to us in good faith does not, by itself, make your finding an “actively exploited vulnerability”: mandatory reporting is not triggered by vulnerabilities identified without malicious intent, such as through good-faith testing or research. Where a regulatory notification is required, we will not include your personal details unless necessary and lawful.

8. Policy details