" "
Schedule a Demo
Schedule a Demo

CVD Policy

Coordinated Vulnerability Disclosure Policy

At MOV.AI, we are committed to the safety, security, and resilience of our robotics middleware, Autonomous Mobile Robot (AMR) software ecosystems, and corporate infrastructure. In alignment with international standards (ISO/IEC 29147) and the European Union Cyber Resilience Act (CRA), we welcome disclosures from independent security researchers, customers, and the global DevSecOps community to help us protect our ecosystem.

If you believe you have discovered a security vulnerability impacting a MOV.AI product or asset, we encourage you to report it to us safely and confidentially using the guidelines below.

What we expect from you

MOV.AI deeply values the work of ethical security researchers. If you conduct your vulnerability research and make your disclosure in accordance with the rules of engagement outlined in this policy, we commit to the following:

  • No Legal Action:We will consider your research authorized and will not initiate or support legal action against you regarding your discovery.

  • Confidentiality:We will protect your identity and work with you to understand and remediate the issue before public disclosure.

  • Coordination:We will keep you updated as we triage, validate, and patch the vulnerability.

Rules of Engagement & Robotics Safety Guardrails

Because MOV.AI software controls physical industrial equipment and automated robotics systems, security testing carries unique, real-world physical risks. You must strictly adhere to the following constraints:

⚠️ All vulnerability research must be strictly confined to virtual simulations, isolated local testing containers, or sandboxed development environments. Under no circumstances should security testing, fuzzing, or active scanning be performed on live production systems, active customer warehouse deployments, or physical industrial equipment in operation.

Prohibited Activities

To maintain Safe Harbor protection, you must not engage in:

  • Denial of Service (DoS/DDoS) attacks that disrupt corporate or customer operations.

  • Social engineering, phishing, or physical security attacks against MOV.AI employees, facilities, or partners.

  • Exfiltration, modification, or destruction of corporate or customer data. If you accidentally access private data, halt your research and notify us immediately.

  • Submitting raw, unvalidated outputs from automated vulnerability scanners without manual analysis or proof-of-concept validation.

 

How to Submit a Report

To ensure your submission reaches our DevSecOps Response Team with zero latency, submit your report directly into our portal: MOVAI Security Service Desk

Note: Alternatively, you can transmit your findings via email to our inbound team here

Skip to content