Found a hole?
Tell us.

How to report

Write to navivolta.app@gmail.com with a subject starting with SECURITY. Describe what you found, how to reproduce it and what you think could happen. Screenshots and recordings help — blur other people's data first.

The same address is in /.well-known/security.txt (RFC 9116).

What we promise

• An acknowledgement within 5 working days, written by a person, not a robot.
• An assessment within 14 days: whether we confirm it, how serious it is, what we will do.
• To keep you posted until it is fixed, and to tell you when the fix ships.
• To credit you if you want it — or not to name you if you prefer.
• Not to take legal action against you if you followed the rules below.

There is no bug bounty yet: the project is one person with no revenue. We say so rather than stay silent about it.

The rules

• Work only with your own data and account. Do not touch other testers' data.
• Do not overload services — ours or our providers' (maps, charging operators).
• No social engineering against people, and never ask anyone for a password.
• Do not publish before we have fixed it or before 90 days have passed since your report, whichever comes first. If it is serious and we go quiet, tell us you are about to publish.
• Do not ask for money in exchange for telling us what you found.

Scope

• The NaviVolta Android app (the current test version in Google Play).
• The navivolta.app website.
• How data is stored and transmitted — including what the app sends to the map provider and to the charging operators.

Out of scope: the systems of Google, Mapbox, Cloudflare and the charging operators — report those to them. If we misconfigured something of theirs, that is ours and we want to hear it.

If it is already being exploited

Say so in the first sentence. An actively exploited vulnerability has to be reported under the EU Cyber Resilience Act (Regulation (EU) 2024/2847) on short deadlines, so we need it now, not at the end of the week.

What we do on our side

The list of libraries in the app (SBOM) and their check against the known-vulnerability database are run regularly; that check is part of our test gate and fails if it is more than 30 days old or if an unchecked library went in.

The app is an early Alpha. That is no excuse for a security hole — it only means a fix sometimes ships with the next version rather than the same day.