Report a vulnerability

Write to info@webpx.de, ideally with the subject “Security report”, in German or English.

It helps to include:

• what is affected: website, customer portal, app (with version) or interface
• the steps that reproduce the problem
• what an attacker could achieve with it
• how we can reach you with questions

Please do not send credentials or other people’s data by email. If a protected channel is needed, we will arrange one with you.

• forkscan.pro with the customer and administration areas
• the ForkScan Pro apps
• the interfaces through which the app and the website talk to our backend, and the interface through which our staff maintain the error codes (MCP)

Please report vulnerabilities in third-party services we use (such as payment processing or app stores) to the respective provider. If it concerns the way we integrate such a service, you are in the right place.

• We acknowledge your report, usually within five working days.
• We tell you how we assess the report and keep you informed about the fix.
• We fix confirmed vulnerabilities as quickly as their severity demands and provide security updates free of charge.
• Anyone acting in good faith and within the rules below need not expect legal action from us. This commitment binds only WebPX - Graupner & Kozhevnikov GbR; it cannot bind third parties or law enforcement authorities.
• If you wish, we name you as the finder once the issue is fixed.

We do not currently pay a reward (bug bounty).

• Test only with your own accounts and your own data.
• Do not access, change or delete other people’s data; proof that it would be possible is enough.
• No attacks that disrupt the service (overload, mass requests), no social engineering, no spam.
• Give us time to fix the issue before you publish details: usually 90 days from your report.

Security updates are free of charge. You update the app through the App Store or Google Play; keep automatic updates switched on. We update the website and the backend ourselves; there is nothing for you to do.

• The app receives security updates at least until the end of the support period of its main version, whether or not a trial or a plan is running for your company. After the trial or the plan has ended, the app shows your company's stored vehicle data for another 12 months; error code lookups and editing are then locked. If no plan is running by then, the data are deleted.
• Every main version of the app (for example 2.x) receives security updates for at least two years from its release, in its latest edition.
• The end date of a main version is stated here as soon as it is released.

The system status page reports disruptions.

System status

WebPX - Graupner & Kozhevnikov GbR Reumtengrüner Str. 32B 08209 Auerbach Germany

Contact for security reports: info@webpx.de

ForkScan Pro is made for companies: to look up error codes of industrial trucks, to manage their own fleet and to document errors.