Security
Security and vulnerability disclosure
How to report a vulnerability in Volt Software's products, what I do with it, how long each product gets security updates, and the advisories published so far.
Last updated 1 November 2026.
Reporting a vulnerability
Email michael@volt-software.nl with "Security report" in the subject. Please include:
- the product and version, or the URL, that is affected;
- what an attacker can do, and what they need to do it;
- steps or code to reproduce it;
- whether you know of it being used in an attack.
Reports in English or Dutch are both fine. The same contact is in security.txt.
What this covers
- Groundplane: the stage 0 bootloader, the update mechanism, the cryptography and the rest of the foundation.
- BusBench: the fixture's firmware and its host software.
- This website.
A vulnerability in a component Groundplane or BusBench uses, such as FreeRTOS or TinyUSB, is in scope when it affects my product. I'll pass it on to the component's maintainers, or fix it myself where I maintain the code, as with my fork of micro-ecc.
What happens after you report
- Within 3 working days: I confirm I have your report.
- Within 10 working days: I tell you whether I can reproduce it, how severe I think it is (CVSS), and what I plan to do.
- Fix: I aim to release a fix within 30 days for critical and high severity, and within 90 days for medium and low. If a fix takes longer, I tell you why and when to expect it.
- Disclosure: once the fix is released, I publish an advisory below and request a CVE where one is warranted. I agree the date with you. If no fix is released within 90 days of your report, you are free to publish.
If a vulnerability is being actively exploited, I report it to the coordinating CSIRT and ENISA as Article 14 of the EU Cyber Resilience Act requires, and the timeline above gets shorter.
Credit and good faith
I credit reporters by name in the advisory, unless you'd rather not be named. There is no bug bounty.
If you act in good faith (you don't access more data than you need to show the problem, don't disrupt anyone's devices or this site, and give me the chance to fix it before you publish), I won't take legal action against you for your research.
Support periods
Security updates are free of charge until the end date of your release line. Fixes come in new releases, each with an advisory, and every release stays available for download for at least ten years.
| Product | Free security updates until |
|---|---|
| Groundplane 1.x | December 2032Never less than five years after the latest 1.x licence, and the date only moves later. The date on the day you sign goes in your licence. |
| BusBench | Declared when it goes on sale; it is in early access |
If your product needs longer, Groundplane licensees can buy extended security updates, up to ten years after their purchase.
Security advisories
No advisories have been published yet.
Each advisory will list the CVE where there is one, the severity, the affected and fixed versions, the time from report to fix, and what you need to do.
Software bill of materials
A machine-readable SBOM in CycloneDX, generated by the build for every Groundplane release, is planned. A sample will be published here.