FleetOptics Inc. · Security

Vulnerability Disclosure Policy

This policy explains how security researchers can report vulnerabilities in FleetOptics systems, what we ask of you, and what you can expect from us.

Version 1.1 · October 2026

Report a vulnerability

1. Our Commitment

Protecting our customers, partners, employees, and the information entrusted to us is fundamental to how Fleet Optics Inc. (“FleetOptics”, “we”, “us”) operates. We maintain an Information Security Management System (ISMS) certified to ISO/IEC 27001:2022, and we regularly test our own systems.

We also recognize that security researchers can help us find weaknesses we may have missed. If you believe you have found a security vulnerability in one of our systems, we invite you to report it to us in good faith, following the guidelines below.

2. Scope

In scope

fleetopticsinc.com and its subdomains, where the system is owned and operated by FleetOptics Inc.

Out of scope

Domains and systems not listed above.
Third-party, vendor, and cloud-provider platforms, including managed service providers, SaaS applications, and other services we use but do not operate.
Systems belonging to our customers or partners.
Physical offices, vehicles, and equipment.
Personal accounts and devices of our employees.

If you believe you have found a vulnerability in a system that is not listed, please contact us first at security@fleetopticsinc.com. We will tell you whether and how you may proceed.

3. Rules of Engagement

Please

Report a vulnerability as soon as you discover it.
Use only accounts that you own or have explicit permission to use.
Use exploits only to the extent necessary to confirm that a vulnerability exists. Do not use a vulnerability to move to other systems, establish persistence, or gain further access.
Avoid privacy violations, degradation of our services, disruption to our operations, and destruction or modification of data.
If you inadvertently access personal or confidential data, stop testing, do not save, copy, or share it, and tell us immediately.
Keep personal or sensitive data out of your report. Redact anything that is not needed to reproduce the issue.
Give us a reasonable amount of time to fix the issue before any public disclosure (see Coordinated Disclosure).

Please do not

Perform denial-of-service (DoS/DDoS) attacks or any testing that could degrade or interrupt our services.
Use brute-force, credential-stuffing, or password-guessing attacks.
Use automated scanners or high-volume automated tools.
Send spam or use social engineering (including phishing) against our employees, customers, or vendors.
Attempt physical intrusion into our premises or vehicles.
Introduce malware or leave backdoors or persistent access.
Continue testing after you have discovered a vulnerability, or demand payment or any other benefit in exchange for information about it.

Safe Harbor

If you make a good-faith effort to comply with this policy while researching and reporting a vulnerability, Fleet Optics Inc. will consider your research to be authorized, and we will not initiate or recommend legal action against you in relation to that research.

This authorization applies only to the in-scope systems listed in Section 2. We cannot authorize testing of third-party systems, and activities that breach the rules above or are conducted in bad faith are not covered. If you are unsure whether an activity is covered, contact security@fleetopticsinc.com before proceeding.

4. Vulnerabilities Not Eligible for Reporting

The following are generally low impact and are not of interest to us unless you can demonstrate a realistic, practical exploit:

Self-XSS, or XSS that requires the victim to paste code into their own browser.
Verbose error messages, banners, or directory listings that do not expose sensitive information.
Missing or misconfigured HTTP security headers without a demonstrable impact.
CORS misconfigurations without a demonstrable exploit.
CSRF on unauthenticated forms or on actions with minimal impact.
Clickjacking on pages that contain no sensitive actions.
SSL/TLS configuration weaknesses (for example, cipher suites or missing HSTS) without a demonstrable exploit.
Email authentication findings (SPF, DKIM, DMARC) and email spoofing reports.
Cookie flag findings without a demonstrable impact.
Missing rate limiting on non-sensitive functions.
Software or version disclosure without a working exploit.
Theoretical issues without a realistic exploitation scenario.
Output from automated scanners that has not been validated.
Vulnerabilities affecting only outdated or unsupported browsers and platforms.

If a vulnerability is already known to us or has been reported by someone else, we will let you know that your report is a duplicate.

5. How to Report a Vulnerability

Please send your report by email to security@fleetopticsinc.com with the subject line “Vulnerability Report – [short title]”. Reports should be written in English.

To help us validate and fix the issue quickly, please include:

The URL or system affected, and the date and time of your testing.
The type of vulnerability and a clear description of it.
The potential impact, and how it could be exploited.
Step-by-step instructions to reproduce the issue.
Proof-of-concept material such as screenshots, request/response samples, or a short video. Please do not include malicious payloads.
Your contact details and whether you would like to receive updates. You may report anonymously, but we will then be unable to follow up with you.

Please do not include sensitive technical details (such as credentials, session tokens, or working exploit code) in your first email. We will provide a secure link through which you can submit these documents and materials.

This policy covers security vulnerabilities only. For general questions or service issues, please visit fleetopticsinc.com/contact-us. For security-related inquiries, contact security@fleetopticsinc.com.

6. What You Can Expect From Us

We take every report seriously and will handle it confidentially. We will acknowledge receipt, and keep you informed of our progress and of any obstacles we encounter. Our targets are:

Stage	Target
Acknowledgement of your report	Within 5 business days
Initial assessment and validation	Within 10 business days
Resolution	Depends on severity and complexity; we will tell you when the issue is fixed

These are targets, not guarantees. We may share relevant details with affected vendors or partners where needed to resolve the issue.

7. Coordinated Disclosure

We ask that you keep vulnerability details confidential and not share them publicly or with third parties until the issue has been remediated and we have mutually agreed on the timing and content of any disclosure.

We will keep you informed of our progress and work to resolve valid issues without undue delay. Remediation timelines may vary depending on the complexity of the issue, and we will work with you in good faith to agree on an appropriate disclosure date.

We aim to remediate valid vulnerabilities within 90 days of your report. If we need more time, we will explain why and agree on an extended date with you. If no agreement has been reached after 90 days, you may request to disclose the vulnerability by giving us at least 14 working days’ written notice at security@fleetopticsinc.com. Public disclosure may proceed only after you have received written approval from us, which we will not unreasonably withhold.

Under no circumstances should personal data, customer data, or other confidential information obtained during your research be published or shared.

8. Rewards and Recognition

FleetOptics does not operate a bug bounty program. We do not offer payment or other compensation, and we do not publicly list contributors. We do sincerely appreciate your effort and will thank you personally for a valid report.

By submitting a report, you waive any claim to compensation, and you grant FleetOptics the right to use the information in your report to investigate, fix, and improve the security of our systems.

9. How We Handle Your Information

We use the contact details and other personal information you provide only to assess your report and to communicate with you about it. We handle this information in accordance with our Privacy Policy and applicable Canadian privacy law.

10. Acceptance of This Policy

By sending a report to security@fleetopticsinc.com, you confirm that you have read and agree to the terms of this policy.

11. Policy Management

This policy is owned by the FleetOptics IT and Security team, is reviewed at least annually, and may be updated at any time.