Security policy

This is our Coordinated Vulnerability Disclosure (CVD) policy.

Found a weak spot in one of our products or systems? Let us know by following the instructions below, and we'll work with you to fix it.

Report a vulnerability

Report a vulnerability to security@currentt.nl.

Report vulnerability

Please read the instructions below first. Your report should include at least:

What you found and where: the product, URL, firmware version or Navigator serial number;
How to reproduce it, or a proof of concept;
What an attacker could do with it, as far as you can tell;
How we can reach you.

This policy covers all of Currentt's systems, and in particular:
- Currentt Navigator: its hardware and firmware;
- Currentt platform: the dashboard and API at app.currentt.energy and navigators.currentt.energy;
- Currentt App: the native application for iOS and Android.
Is the vulnerability in a third-party service that we use? Then please report it to that party. If it affects our customers' data, let us know as well.

Report the vulnerability as soon as possible after you find it. Don't share it with others until it is fixed or we have agreed on a disclosure date together;
Only test against accounts and Navigators that are yours, or that you have permission to test;
Do no more than you need to demonstrate the vulnerability. Don't copy, change or delete data that isn't yours. If you reach other people's data anyway, stop and let us know;
Don't use denial-of-service attacks, social engineering or phishing, and don't physically attack our people, our premises or other people's devices;
Don't install backdoors or malware, and don't use the vulnerability to get into other systems;
Communicate with us personally; please don't use AI to write your messages.

We confirm receipt of your report within 5 working days, and send you a first assessment within 10 working days of your report;
We keep you updated while we work on a fix;
We agree with you when the vulnerability will be made public. Our default is 90 days after your report. It can be sooner if a fix is ready earlier. It can only be later if a fix needs more time and we have explained why;
If you have followed this policy, we will not take legal action against you over your report, and we will not report you to the police;
We treat your report confidentially and don't share your personal details without your permission, unless the law requires us to;
If you want, we credit you by name in the security advisory we publish about the vulnerability;
We don't run a bug bounty programme and don't pay for reports.

Last updated on October 16 2026.