Report a security vulnerability

Gunnebo welcomes reports from security researchers and members of the public who find vulnerabilities in our systems. We prefer to hear about a weakness from you before anyone else finds it.

For security vulnerabilities affecting products with digital elements or digital solutions that are supported and maintained by Gunnebo Safe Storage, Chubbsafes, Tecnosicurezza, PrimatbyGunnebo or Carl Wittkopp, please refer to each Product Vulnerability page and use the reporting process described there.

Scope

This process covers Gunnebo’s corporate IT estate: gunnebo.com and its subdomains, our other public websites and mail domains, and any internet-facing service operated by Gunnebo Group IT.

How to report

Email cvd@gunnebo.com with:

• a description of the vulnerability and where you found it (URL, IP address or service)
• steps to reproduce it, or a proof of concept
• your assessment of the impact
• a way to reach you for follow-up questions

We accept reports in English and Swedish. If your report contains sensitive data, say so in a first mail without the details and we will arrange a secure channel.

What you can expect from us

We will acknowledge your report within five working days. We will keep you informed of our progress, tell you when the issue is resolved, and credit you for the find if you want to be credited. We do not operate a bug bounty programme and do not pay monetary rewards.

Our ask of you

• Act in good faith: do not exploit the vulnerability beyond what is needed to demonstrate it.
• Do not access, modify or delete data that is not yours. If you encounter personal or confidential data, stop and report.
• Do not disrupt our services, and do not use social engineering, phishing or physical intrusion.
• Give us reasonable time to fix the issue before you disclose it publicly. We are happy to agree a disclosure date with you.

Safe harbour

If you follow the guidelines above, Gunnebo will not initiate legal action against you for your research and will consider it authorised in the sense of applicable anti-hacking legislation. This does not apply to research that harms Gunnebo, our customers or third parties, or that breaks the law in other respects.

This page and gunnebo.com/.well-known/security.txt follow RFC 9116. Last reviewed: [28/08/2026].