Swedavia Vulnerability Disclosure Policy

Reporting scope

We welcome reports concerning publicly accessible assets owned or operated by Swedavia under swedavia.se and airportnet.se, including their subdomains. We also welcome reports about other Swedavia assets if an issue was discovered without unauthorised testing.

The presence of an asset under either domain does not, by itself, authorise security testing of that asset.

Authorised testing

Active testing is authorised only for assets expressly listed as in scope in Swedavia’s current Intigriti programme, and only in accordance with that programme’s rules of engagement. If an asset or activity is not clearly authorised there, contact us before testing.

This policy does not authorise testing of operational airport systems, industrial control systems, aviation or radio systems, internal networks, physical infrastructure, or systems operated by airlines, tenants, suppliers or other third parties.

When testing is authorised, use only the minimum activity needed to establish an issue. Do not disrupt services, affect other users, use denial-of-service or brute-force techniques, perform social engineering or physical intrusion, or access or retain information beyond what is necessary to demonstrate the vulnerability. Stop and report immediately if you encounter sensitive information or a risk of disruption.

Reporting

Submit reports through Intigriti or email cybersecurity@swedavia.se. Intigriti is our preferred reporting channel.

Please describe the affected asset, the issue, its potential impact and safe steps for reproducing it. Include only the evidence necessary for assessment. Harmful or extensive exploitation is not required.

We aim to acknowledge reports within ten working days of receipt. Reports submitted through Intigriti may be initially assessed by our triage partner. We may contact you for further information and will coordinate assessment and remediation.

Rewards

This public Vulnerability Disclosure Policy does not offer a financial bounty for initial reports. An invitation to a separate private programme or compensation for an agreed re-test is at Swedavia’s discretion and requires a separate arrangement.

Safe harbour

Swedavia will not initiate legal action or report a researcher to law enforcement solely for good-faith reporting or testing that remains within the scope expressly authorised by Swedavia and complies with the applicable rules.

Swedavia cannot authorise activity against systems it does not control. This commitment does not bind third parties or public authorities. If a third party raises concerns about activity that complied with Swedavia’s authorisation, we will take reasonable steps to explain that authorisation.

Coordinated disclosure

Please keep vulnerability details confidential and coordinate any proposed public disclosure with us. We normally use a period of at least 90 days from receipt of a sufficiently detailed report to assess and address the issue, but the appropriate disclosure date depends on the circumstances. The passage of 90 days does not itself constitute approval to publish.

For reports submitted through Intigriti, its disclosure rules also apply. Public disclosure requires the written approvals specified by those rules.