MAFELEC TEAM designs interfaces for safety-critical railway, aeronautical, defense and industrial systems. Security is engineered into our products from the earliest design stage, and we work openly with the security research community to keep them that way throughout their service life.
We welcome reports from customers, integrators, researchers and members of the public. Every report is reviewed by our product security team and handled under the terms of our Coordinated Vulnerability Disclosure Policy below.
Send your report by email to our dedicated security contact. Please include, where possible: Product name and reference, product version (hardware, firmware, software) and configuration, type of vulnerability, a clear description of the issue, the steps to reproduce it, its potential impact and contact details of the reporter. If you have evidence (proof-of-concept, code, scripts, screenshots, logs, traces …), attach it. We treat all submissions as confidential.
If you prefer, you may also report through your usual MAFELEC TEAM commercial or technical contact, who will route your message to the product security team without delay.
Where sensitive technical information is included in a vulnerability report, MAFELEC TEAM may request that the information be exchanged using an appropriate secure communication mechanism.
Monitored by MAFELEC TEAM’s product security team. Acknowledged within 5 business days.
This is the process we follow once a vulnerability report reaches security.product@mafelec.fr, from initial contact to public resolution.
Business days to acknowledge
Every report submitted to security.product@mafelec.fr receives a confirmation and a tracking reference.
Days to initial assessment
Severity, affected scope and a remediation plan are communicated back to the reporter.
Days coordinated disclosure window
Standard target for fix development and disclosure, adjustable by mutual agreement for complex or safety-critical cases.
MAFELEC TEAM’s Coordinated Vulnerability Disclosure (CVD) Policy sets out how we work with security researchers and how we ask them to work with us, in line with Article 14 of the Cyber Resilience Act and ENISA’s recommended good practice.
MAFELEC TEAM will not pursue legal action against researchers who make a good-faith effort to comply with this policy: testing only on systems you own or are authorized to test, avoiding data destruction or service disruption, not accessing or exfiltrating data beyond what is needed to demonstrate the issue, and reporting the finding to us before disclosing it publicly.
| Scope | Details |
|---|---|
| In scope | All MAFELEC TEAM products with embedded digital element and logic (hardware, firmware, embedded software, software components, interfaces, communication protocols, associated configuration tools), and the mafelec-team.com web infrastructure. |
| Out of scope | Purely electromechanical components without embedded digital element and logic; third-party products integrated by MAFELEC TEAM but not manufactured by MAFELEC TEAM; social engineering or physical attacks against MAFELEC TEAM premises or staff. |
| Confidentiality | Reports and reporter identities are handled confidentially and shared only within the product security team and, where needed, with affected customers under NDA. |
| Recognition | With the reporter’s consent, valid findings are acknowledged in the published advisory. |
Full versions of the documents referenced on this page are available below.
You need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Turnstile. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information