Report a security vulnerability
Last updated
Our robots move heavy loads alongside people, so we take the security of our robots, software and websites seriously. If you believe you’ve found a vulnerability, please tell us first and give us a chance to fix it.
How to report
Email security@goat-robotics.com. Please include:
- the affected product, version, URL or component;
- a description of the issue and its potential impact;
- step-by-step instructions or a proof of concept to reproduce it;
- how you’d like to be credited, if at all.
Please don’t include personal data you may have accessed; describe it instead. If you need encrypted communication, say so in your first email and we’ll arrange it.
Scope
In scope:
- goat-robotics.com and its subdomains;
- GT Studio fleet management software, including its APIs and VDA 5050 interfaces;
- software and firmware running on GOAT robots, and their network and service interfaces.
Out of scope:
- denial-of-service, load or volumetric testing;
- social engineering, phishing and physical attacks on our people or premises;
- robots or GT Studio installations at customer sites, unless the customer has authorised you in writing;
- third-party services we use, such as email and analytics providers — report those to the provider;
- findings without demonstrable security impact, such as missing headers on non-sensitive pages, clickjacking on pages without actions, or self-XSS.
Rules of engagement
- Safety first: never test in a way that could move a robot unexpectedly, disable a safety function, or endanger people or property.
- Access only the data you need to demonstrate the issue, and don’t modify, delete or retain it.
- Don’t degrade or disrupt our services or anyone else’s.
- Give us reasonable time to fix the issue before telling anyone else.
Our commitments
- We’ll acknowledge your report within 3 business days.
- We’ll give you an initial assessment within 10 business days and keep you updated until it’s resolved.
- We aim to fix valid vulnerabilities within 90 days, faster for critical issues, and will agree a disclosure date with you.
- With your permission, we’ll credit you publicly when we disclose the fix.
Safe harbour
If you make a good-faith effort to follow this policy, we will consider your research authorised, won’t pursue or support legal action against you for it, and will work with you to understand and resolve the issue. If legal action is started by a third party, we will make it known that your activities were conducted in line with this policy.
security.txt
Our contact details are also published in machine-readable form at /.well-known/security.txt (RFC 9116).