Security and vulnerability disclosure

How to report a security vulnerability in an EpiSensor product or service, and what we do when you do.

1. Scope

This policy covers security vulnerabilities in EpiSensor products and services: EpiSensor Edge (including the free edition on a Raspberry Pi), System Manager, Core, EpiSensor Gateways, EpiSensor devices and their firmware, and EpiSensor's websites and online services. It also covers third-party software that EpiSensor includes in its products.

A vulnerability in another manufacturer's product that is connected to an EpiSensor product should be reported to that manufacturer. Tell us as well if it affects how our products work with it.

2. How to report

Email security@episensor.com. Please write in English if you can. If you are not sure whether something is a vulnerability, report it anyway.

The same contact is published in machine-readable form in our security.txt file.

3. What to include

  • The product and version you tested, for example the Edge version and the hardware it runs on, or the address of the web page.
  • What the vulnerability is and what an attacker could do with it.
  • The steps to reproduce it, with any proof-of-concept code, logs or screenshots.
  • Whether you believe it is being exploited.
  • Whether and how you would like to be credited.

Do not include personal data that you do not need to show the problem.

4. What we commit to

  • We acknowledge your report within five working days.
  • We assess it, tell you whether we can reproduce it and keep you informed until it is resolved.
  • We fix confirmed vulnerabilities and make security updates available free of charge, including for the free edition of Edge.
  • When a fix is available, we publish an advisory that describes the vulnerability, the affected versions and how to fix or mitigate it, and we credit you if you wish.
  • We notify actively exploited vulnerabilities and severe incidents to the CSIRT designated as coordinator and to ENISA, as the EU Cyber Resilience Act (Regulation (EU) 2024/2847) requires, and we tell affected users what they can do to reduce the risk.

We do not offer payment for reports.

5. Coordinated disclosure

Please give us the chance to fix a vulnerability before its details are made public. If you report a vulnerability, you agree not to publish its details until we have released a fix or 90 days have passed since your report, whichever is sooner. We can agree a different date with you, for example a later one when a fix has to reach devices installed in the field, or an earlier one when the vulnerability is being exploited.

You may share your findings with the owner of the installation you tested, and you may report a vulnerability to a national computer security incident response team (CSIRT) or another competent authority at any time.

6. Rules for security testing

  • Test only installations that you own or operate, or that their owner has authorised you to test.
  • Do not test the systems, networks, devices or data of anyone else. Do not run scans or attacks against EpiSensor's websites and online services: if you notice a problem there, report it without testing further.
  • Do not disrupt or degrade any service, network or device, for example by denial-of-service testing, and take care not to affect equipment that Edge monitors or controls.
  • Do not access, copy, keep, change, delete or disclose data that is not yours beyond the minimum needed to show that a vulnerability exists. If you reach such data, stop, tell us and delete any copy you hold.
  • Do not use social engineering, phishing or physical attacks against EpiSensor, its staff, its customers or its premises.
  • Comply with the law. The licence agreement allows decompiling and other reverse engineering only as far as the law allows.

7. Safe harbour

We will not bring a claim against you, or ask any authority to act against you, for security research and reporting that you carry out in good faith and in line with this policy. The same terms are part of the EpiSensor Edge licence agreement, in section 2.3.

This policy cannot authorise testing of systems that belong to someone else. If in doubt, ask us before you test.

8. Security updates and support period

We provide security updates for EpiSensor software and firmware free of charge for at least two years from the release of a version or the end of sale of the product, whichever is later, or for longer where the law requires it, for example the support period the EU Cyber Resilience Act sets for products placed on the EU market from 11 December 2027. A security update may be a new version of the software or firmware.

Edge is updated as a snap or through the System Manager desktop app, and firmware for Zigbee devices that support it is updated over the air from Edge. Install security updates promptly: a version outside its support period no longer receives them.