Reporting a vulnerability

If you have found a security vulnerability in Prova — the registry at prova.techrevati.com, or the Prova Edge and Prova Readiness Check apps on Axis cameras — please tell us. We read every report.

How to report

Write to security@techrevati.com. Include what is affected (address, endpoint or component, and the version if you know it), steps to reproduce, the impact you observed and how to reach you. Please do not send personal data of third parties you may have seen — describe it instead.

What happens next

We confirm receipt within five working days. We assess the report, tell you whether we could reproduce it and send you a status update at least every 30 days until it is fixed. Confirmed vulnerabilities take priority. If you wish, we credit you when the fix is published.

Coordinated disclosure

Please give us time to fix before you publish: we ask for 90 days from your report, or less once a fix is available. We agree the publication date with you. We do not run a paid bug bounty programme.

Please

• test only against your own account, your own camera, or data you are allowed to access;
• do not access, change or delete other people’s data, records or images;
• no denial of service, spam or social engineering;
• once you have shown the issue, stop and report it.

Good-faith Security Research / Safe Harbor

TechRevati considers security research conducted in good faith and in accordance with this policy to be authorised with respect to systems and product instances that TechRevati owns or is legally entitled to authorise for testing.

TechRevati will not bring a civil claim or voluntarily request criminal prosecution solely on the basis of security research that complies with this policy.

This assurance does not authorise access to systems, accounts, devices or data belonging to customers or other third parties and does not bind public authorities or third parties.

Researchers must not intentionally access, copy, alter, retain or disclose third-party personal, confidential or proprietary data beyond what is strictly necessary to demonstrate a vulnerability; disrupt or degrade a service; use social engineering, physical attacks, extortion or persistence; or continue testing after TechRevati asks them to stop.

If third-party or personal data is encountered unintentionally, the researcher must stop accessing that data, minimise any copies, notify TechRevati promptly and follow reasonable instructions for secure deletion.

Researchers should provide sufficient information for TechRevati to reproduce the issue and allow a reasonable opportunity to investigate and remediate it before public disclosure.

Nothing in this policy prevents or excuses reporting or disclosure required by applicable law.

Reporting required by law

Where the Cyber Resilience Act requires it (Regulation (EU) 2024/2847, Article 14), TechRevati reports an actively exploited vulnerability in Prova to the designated national CSIRT and to ENISA.

Security support period

Prova Edge receives security updates at least until September 2033; Prova Edge Evidence receives security updates at least until October 2033. Prova Readiness Check has not been offered yet; its end of security support, seven years from its first offer, is published here when it is first offered.

TechRevati determines and publishes the security support period for each Prova product based on its expected duration of use and applicable legal requirements. The published support end date will not result in a support period shorter than the minimum required by applicable law. TechRevati's standard policy is to provide at least seven years of security support for the relevant major product release, subject to any longer period required for products subsequently made available on the market.

Security updates are free of charge and reach the newest version. That version runs only on the cameras and AXIS OS versions it lists, so a camera outside them has no update. Before buying, check a camera against that list.

Advisories

Fixed vulnerabilities are published as security advisories.