You are here: / Security

Product Security and Vulnerability Disclosure

Prima sistemi d.o.o. develops FlexAir access control systems (controllers, readers, locks), the Nova software, the Nova Cloud and MiniCloud cloud services and the DoorApp mobile application. We take the security of our products seriously and value every report that helps us fix a vulnerability.

How to report a vulnerability

Send your report to security@primasystems.si in English or Slovenian. Please include:

  • the product and version (e.g. Nova 3.3, controller firmware, DoorApp 1.1.101);
  • a description of the vulnerability and its potential impact;
  • steps to reproduce or a proof of concept;
  • your contact details for follow-up.

What happens next

  • We acknowledge receipt within 3 working days.
  • We assess severity using CVSS and check whether the vulnerability is actively exploited.
  • We keep you informed until it is resolved.
  • We aim to fix critical vulnerabilities within 14 days and high-severity ones within 30 days. Where a fix is not immediately available, we advise customers on interim measures.

Coordinated disclosure

Please do not publish details of the vulnerability until a fix is available or until an agreed date. With your consent, we will credit you as the reporter.

Research guidelines

  • Test only on your own equipment, your own accounts or test environments.
  • Do not access, modify or delete other people’s data. If you access such data by accident, stop and let us know.
  • Do not perform denial-of-service, social engineering or physical attacks on customer installations.

We treat good-faith reports that follow these guidelines as a contribution to the security of our products.

Notifications and updates

We inform customers and integrators about fixed vulnerabilities through security advisories. We report actively exploited vulnerabilities and severe incidents affecting product security to the competent authorities in accordance with the Cyber Resilience Act (CRA). Security updates are provided for the support period of each product, which is stated at the time of purchase.

Security incidents

Customers report security incidents and suspected personal data breaches to the same address: security@primasystems.si.