Tellus Power Vulnerability Disclosure Policy

Our commitment

Tellus Power welcomes reports of security vulnerabilities in our products and services, and we will work with you to fix them. Our chargers and the systems behind them are part of Europe's energy infrastructure, so we treat every report seriously.

This policy explains what you can report, how to report it, what you can expect from us, and how we protect researchers who act in good faith. It follows the principles of ISO/IEC 29147 and ISO/IEC 30111 and supports our obligations under the EU Cyber Resilience Act (Regulation (EU) 2024/2847).

Scope

This policy covers all Tellus Power products with digital elements placed on the EU and UK markets, and the services that support them:

• AC and DC electric vehicle chargers, including their firmware and hardware
• Wireless and network interfaces on our chargers (Wi-Fi, cellular, Bluetooth, Ethernet, RFID)
• The Tellus Power operations and management platform that our chargers connect to, including:
  • the OCPP and charger management connection endpoints used by our chargers
  • firmware update delivery to chargers
  • remote diagnostics, configuration and maintenance access to chargers
  • the operator web portal and its APIs, including login and single sign-on
• Tellus Power mobile apps, web portals and APIs
• Websites under telluspowergroup.com

The following are out of scope:

• Denial-of-service or load testing against live systems
• Social engineering, phishing or physical attacks on Tellus Power staff or offices
• Physical tampering with chargers installed in public or on property you do not own or control
• Vulnerabilities in third-party products or services we do not operate, including third-party charge point management systems (CPMS/CSMS) our chargers connect to (please report these to the vendor; we are happy to help coordinate)
• Reports from automated scanners without a demonstrated security impact
• Pre-release, test and staging environments

How to report a vulnerability

Email [email protected]. This mailbox is monitored by our product security team. Reports can be in English.

To help us act quickly, please include:

• The product, model and firmware or software version affected
• A description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce it, with any proof-of-concept code, screenshots or logs
• Whether you believe it is being actively exploited
• How you would like to be credited, or whether you prefer to stay anonymous

If your report contains sensitive details, email us first and we will arrange a secure way to share them. Please do not report vulnerabilities through social media, customer support channels or public issue trackers.

What happens after you report

We acknowledge every report within 3 business days and keep you informed until the issue is resolved.

We aim to remediate confirmed vulnerabilities within these target timelines:

Fixes for charger firmware may need certification testing and staged rollout to installed units. If a fix will take longer than the target, we will explain why and agree a revised timeline with you. Security updates for our products are provided free of charge.

Coordinated disclosure

We ask that you keep the vulnerability confidential until a fix or mitigation is available, or until 90 days after your report, whichever comes first. If we need more time, we will ask you before that date and explain why.

When a fix is released, we publish a security advisory describing the issue, the affected products and versions, and how customers can protect themselves. Where appropriate, we request a CVE identifier. We will agree the publication date with you and credit you in the advisory if you wish.

Regulatory reporting

Under Article 14 of the EU Cyber Resilience Act, we notify actively exploited vulnerabilities and severe security incidents to the relevant national CSIRT and ENISA through the Single Reporting Platform. If your report concerns an actively exploited vulnerability, we may need to share technical details with these authorities within 24 hours. We will tell you when we do so. We also inform affected customers about vulnerabilities and the measures they can take.

Safe harbour

If you research and report a vulnerability in good faith and in line with this policy, Tellus Power will not take legal action against you or ask law enforcement to investigate you. If a third party takes legal action against you for activities covered by this policy, we will make it known that you acted with our authorisation.

To stay within this policy, please:

• Only test equipment and accounts you own or have explicit permission to use
• Stop testing and contact us as soon as you find a vulnerability
• Access or keep only the minimum data needed to show the issue, and delete it once reported
• Not disrupt charging sessions, energy delivery, billing or other users' services
• Not install persistent malware, pivot to other systems or change data that is not yours
• Not demand payment or other benefit in exchange for not disclosing a vulnerability

This safe harbour does not cover activities that are out of scope or that break the law. If you are unsure whether your testing is allowed, ask us first at [email protected].

Recognition

We do not currently run a paid bug bounty programme. With your permission, we credit researchers by name or handle in our security advisories.

Policy updates

We review this policy at least once a year and may update it at any time. The latest version is always published on this page.

Contact: [email protected]