/.well-known/security.txt (RFC 9116)
Our commitment
Lohmega AB welcomes reports of security vulnerabilities in the Semafor system (the signs, their firmware, and the backend at tb.lohmega.com). We will work with you to understand and resolve the issue, and we will not pursue legal action against researchers who act in good faith within the scope and guidelines of this policy.
Scope
In scope: the Semafor sign firmware and bootloader, the sign's LoRaWAN and BLE interfaces, the backend service with its APIs and web interfaces at tb.lohmega.com (and the staging instance tb-dev.lohmega.com), and the firmware update mechanisms.
Out of scope: third-party infrastructure we do not control (the LoRaWAN network operator, gateway vendor firmware, transit data providers, hosting); denial of service; social engineering; physical attacks on staff or on the signs. Report an issue in a dependency to that project, and optionally to us.
How to report
- Email: nc@lohmega.com (Niklas Casaril, Lohmega AB). We read reports in English and Swedish.
- No PGP key is published yet. If your report contains sensitive material (a working exploit, personal data), say so in a first plain-text email and we will agree an encrypted channel before you send it.
- Please include: the affected component and version (firmware version, or the backend URL), steps to reproduce, the impact as you understand it, and any proof of concept. Do not include third-party personal data.
What to expect
Business days are Swedish working days.
| Stage | Target |
|---|---|
| Acknowledgement of your report | within 3 business days |
| Initial assessment (reproduced or not, severity, affected versions) | within 10 business days |
| Progress updates | at least every 30 days until resolved |
| Coordinated public disclosure | by agreement, typically within 90 days of the report |
If a fix needs longer than 90 days — a fleet-wide firmware rollout can — we will say so, explain why, and agree a new date with you.
Our commitments to you
- We keep you informed through the stages above and, unless you prefer otherwise, credit you when we publish the fix.
- We handle actively exploited vulnerabilities under our obligations as a manufacturer under the EU Cyber Resilience Act (Art. 14); a report may trigger a regulatory notification, and we will tell you if it does.
- When a fix ships we publish a description of the vulnerability, its impact and the remediation (affected and fixed versions) in the changelog of the fixing release and under Advisories below.
Good-faith guidelines
Give us reasonable time to fix before public disclosure; do not access or modify data beyond what is needed to demonstrate the issue; do not degrade the service (the signs are in daily use by ferry passengers); comply with applicable law. Research that follows these guidelines is authorised within the scope above.
Advisories
No advisories have been published yet.
security.txt
Our RFC 9116 contact file is at /.well-known/security.txt. It is reviewed at least yearly and currently expires on .