Northvolt Vulnerability Disclosure

generated: '2026-08-26'
method: searched
source: https://www.datocms-assets.com/38709/1619082808-responsible-disclosure-program.pdf
docs: https://northvolt.com/
program:
  name: Responsible Disclosure Program
  published: true
  format: PDF
  url: https://www.datocms-assets.com/38709/1619082808-responsible-disclosure-program.pdf
  http_status: 200
  discovery: >-
    Linked as "Responsible Disclosure" from the global footer of northvolt.com. It is NOT
    served from /.well-known/security.txt -- that path returns the site's soft-404 HTML
    shell (see well-known/northvolt-well-known.yml), so the program is invisible to any
    RFC 9116 consumer.
  contact: responsibledisclosure@northvolt.com
  contact_method: email
  bug_bounty: false
  safe_harbor: true
  safe_harbor_text: >-
    "By responsibly submitting your findings to Northvolt in accordance with these
    guidelines Northvolt agrees not to pursue legal action against you."
  acknowledgement_sla: two to three business days
  coordinated_disclosure: >-
    Researchers must give Northvolt reasonable time to fix a reported issue before
    sharing it with a third party or disclosing publicly. No fixed embargo window is stated.
  scope: any product, system, or asset belonging to Northvolt
  out_of_scope:
  - Physical testing
  - Social engineering (cookie theft, fake login pages to collect credentials)
  - Phishing
  - Denial of service attacks
  - Resource exhaustion attacks
  submission_format: >-
    Detailed summary of the vulnerability including target, steps, tools and artifacts
    used during discovery; screen captures welcome.
security_txt: false
security_txt_note: >-
  https://northvolt.com/.well-known/security.txt returns HTTP 200 with the Gatsby SPA
  soft-404 shell, not an RFC 9116 document.
caveat: >-
  Northvolt AB entered bankruptcy on 12 March 2025 and its assets were transferred to Lyten
  during 2025. The program document and the responsibledisclosure@northvolt.com mailbox are
  still published on the live site, but neither was re-probed for a live human response and
  the northvolt.com MX still points at Microsoft 365. Treat the contact as published-but-unverified.