Security and vulnerability disclosure

How to report a vulnerability

Email security@hydara.com. Please include:

• what you found and where (the web address, app screen or feature);
• the steps to reproduce it;
• what someone could do with it;
• how we can reach you.

Please keep the details private while we look into them. We will confirm that we received your report and keep you informed as we work on it.

What is in scope

In scope

• hydara.com, and its subdomains that Hydara runs, such as app.hydara.com
• the Hydara mobile app, once it is published

Out of scope

• services run by other companies, including the controller platform's provider, Stripe, Cloudflare and Vercel. Report those to the company concerned. If you are not sure who runs something, tell us.
• controller hardware, and anything at a customer's home
• social engineering or phishing of Hydara staff, partners or customers
• denial-of-service testing, and anything that sends large volumes of traffic or messages
• reports from automated scanners that do not show a real impact

Rules for research

• Use only accounts you own or have permission to use. Never view, change or delete other people's data. If you come across personal data, stop, tell us, and do not keep it.
• Never test against a real customer's tub, unit or home.
• Do not disrupt the website or the app, or slow them down for other people.
• Give us reasonable time to fix a problem before you share it publicly.

Good-faith research

If you make a good-faith effort to follow this policy, we will not bring legal action against you for your research, and we will work with you to understand and fix the problem.

We do not pay for reports at present.

Questions

Questions about this document? Email support@hydara.com or use our contact form.

Postal address: Hydara LLC, Business address to come

See all legal documents