+39 051.419.9111
Contact Us

Product security  

The security of the software we build is part of its quality. If you have found a security vulnerability in LineStrategy, we want to hear about it: this page explains how to report it and what we do once we receive it. 

Write to cybersecurity@nimax.it

We will confirm receipt within 2 business days. 

We accept reports in Italian and English, including anonymous ones. 

If you consider the technical detail too sensitive to send by unencrypted email, write to us without attaching it and we will agree a secure channel with you. 

Send a report
Products in scope 

LineStrategy — all currently supported versions, including server and client components, integration interfaces and associated cloud services. 

Public domains and systems used to deliver and distribute LineStrategy are also in scope. 

Research activities are authorized exclusively on environments that Nimax is authorized to access: this excludes customer installations and systems where LineStrategy is installed, as well as third-party systems. 

Not covered by this programme: third-party products distributed or resold by Nimax — please report those to the respective manufacturer. If you contact us anyway, we will forward your report. 

The full list of exclusions is in our coordinated vulnerability disclosure policy.

What to include in your report  

The more complete your report, the faster we can fix the issue. Where possible, please tell us: 

1 The affected product and version, and the environment where you reproduced the issue
2 The type of vulnerability
3 Steps to reproduce, in as much detail as possible
4 The impact: what an attacker exploiting it could achieve
5 Preconditions: is authentication required? Which role? Is internal network access needed?
6 Supporting material: screenshots, logs, proof of concept
7 How you wish to be credited, or whether you prefer to remain anonymous

What happens next 

1
Within 2 business days
We confirm we have received your report
2
Within 10 business days
We tell you the outcome of our initial assessment
3
Every 30 days
We keep you updated until closure
4
When the fix is released
We publish a security advisory and credit you, if you wish

These timeframes are service objectives, not contractual guarantees: the conditions are set out in our coordinated vulnerability disclosure policy. 

What we ask of you  

While carrying out your research, please do not access, modify or extract data that is not yours, do not degrade service availability, do not use social engineering against our staff, and do not exploit the vulnerability beyond the minimum necessary to demonstrate that it exists. 

If you accidentally come across personal or confidential data, stop, do not copy it, and let us know. 

The full rules are in our coordinated vulnerability disclosure policy.

Our commitment to you

If you carry out your research in good faith, in accordance with our policy and on environments that Nimax is authorized to permit, Nimax undertakes not to initiate or support legal action against you, within the limits set out in the policy. 

This protection does not extend to customers’ installations and systems or to third-party systems. 

Read the full commitment. 

This page is published in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act). 

Learn more 

Coordinated vulnerability disclosure policy

The full document   →

Security advisory

Published security notices →

Acknowledgements

The people who helped us improve the security of our products  →

For enquiries unrelated to product security, please use our general contacts.

For reports of corporate wrongdoing, please use our whistleblowing channel (in Italian).