Security at Telaeris
Telaeris builds XPressEntry, a mobile access control verification platform used at airports, ports, government facilities and critical infrastructure sites. We treat the security of our products as a core responsibility to the customers who rely on them.
Last updated: October 21, 2026
Security leadership
Chris Stotts leads product security at Telaeris. He is accountable for the security of XPressEntry and its supporting services, including secure development practices, vulnerability intake and triage, remediation, coordinated disclosure, and customer security notifications.
Chris works directly with the XPressEntry engineering and handheld badge validation teams and reports to Telaeris CEO David Carta, who holds executive accountability for security at the company.
Responsibilities of the product security function
- Receiving, validating and prioritizing vulnerability reports from researchers, customers and partners
- Coordinating fixes with engineering and verifying them before release
- Publishing security advisories with affected and fixed version ranges
- Requesting and managing CVE identifiers for confirmed vulnerabilities
- Notifying affected customers and providing interim mitigation guidance
- Reviewing security-relevant design and code changes in XPressEntry
- Conducting scheduled offensive security testing of Telaeris products.
Reporting a vulnerability
Reports go directly to the product security team.
If you believe you have found a security vulnerability in a Telaeris product or service, please report it to us privately before disclosing it publicly. Helpful reports include:
- The affected product and version or build number (for example, XPressEntry 3.7.xxxx)
- A description of the issue and its potential impact
- Steps to reproduce, proof-of-concept code, or request/response samples
- Any configuration conditions required for the issue to be exploitable
- How you would like to be credited, if at all
What to expect from us
| Acknowledgement of your report | Within 3 business days |
|---|---|
| Initial assessment and severity | Within 10 business days |
| Status updates | At least every 14 days until resolved |
| Coordinated disclosure window | We ask for 90 days from report to public disclosure, and will work with you on timing if a fix ships sooner or needs longer |
Safe harbor
We will not pursue legal action against researchers who act in good faith under this policy: who avoid privacy violations, data destruction and service disruption; who test only against systems they own or are authorized to test; who do not access more data than needed to demonstrate the issue; and who give us reasonable time to remediate before public disclosure.
Out of scope
- Testing against customer deployments without that customer’s written authorization
- Denial-of-service, physical attacks, and social engineering of Telaeris staff or customers
- Findings from automated scanners without a demonstrated impact
Security advisories
Telaeris publishes security advisories for confirmed vulnerabilities in supported products, including affected and fixed versions and recommended mitigations. Customers with an active support agreement also receive direct notification. For questions about a specific advisory, contact [email protected].
Contact
Telaeris, Inc.
San Diego, California
Security: [email protected]