SECURITY & VULNERABILITY DISCLOSURE
Found a vulnerability?
Tell us.
DEVlink AB makes ChargeLink, including ChargeLink Admin, and the DEVlink Engineering Platform (DEP). We welcome reports of security vulnerabilities in these products and their components, and we work with reporters to fix and disclose them responsibly.
security@devlink.se ↗Security advisories ↓REPORT A VULNERABILITY
One address.
A clear answer.
Email security@devlink.se. Please include:
- the product and version;
- a description of the issue and its impact;
- steps to reproduce or a proof of concept;
- how to contact you.
Leave out any personal data or customer data that you don't need to show the issue.
COORDINATED DISCLOSURE
What we promise.
What we ask.
What we promise
- We confirm receipt within 2 working days and send an initial assessment within 5 working days.
- We keep you informed and agree a disclosure date with you. That date is normally when a fix is available, and no later than 90 days after your report unless we agree otherwise.
- We publish an advisory, and credit you if you wish.
- We do not take legal action against good-faith research that follows this policy.
What we ask
- Give us reasonable time to fix the issue before you disclose it publicly.
- Test only systems and licences that you own or are authorised to test. Don't use denial-of-service attacks, social engineering or physical attacks, and don't access other people's data.
- For charging equipment: never test on chargers or vehicles in public use.
SCOPE
Every product.
Every supported version.
This policy covers all DEVlink products, on every version that still receives security updates. Security updates are free of charge for every licence type.
If a vulnerability is in a third-party component, please also report it to that component's maintainer. We coordinate the response when our products are affected.
Actively exploited vulnerabilities and severe incidents are reported to the authorities, as the EU Cyber Resilience Act requires.
SECURITY ADVISORIES
Published advisories.
Each advisory is also available in the machine-readable CSAF 2.0 format.
| Advisory | Title | Severity | Published |
|---|---|---|---|
| DEVLINK-SA-2026-001 | OpenSSL update in ChargeLink Admin | Low |
ACKNOWLEDGEMENTS
Thank you.
We thank the researchers who report vulnerabilities to us responsibly. With their permission, they are listed here.
No external reports have been received yet.
At a glance.
- Security contact
- security@devlink.se
- Response
- Receipt within 2 working days · assessment within 5 working days
- Disclosure
- Agreed with the reporter, normally within 90 days
- Security updates
- Free of charge for every licence type
- Machine-readable
- /.well-known/security.txt · advisories in CSAF 2.0
- Policy
- Version 1, 26 September 2026
NOT A VULNERABILITY?
Security questions for supplier qualification.
Questionnaires, signed installers and how we work with the Cyber Resilience Act.