Vulnerability Disclosure Policy

This Vulnerability Disclosure Policy (VDP) defines the process by which security researchers, customers, partners, and other external parties can responsibly report potential security vulnerabilities affecting products, software, mobile applications, cloud services, or associated systems provided by Ultrahuman.

This page is the canonical policy. It is published in English and can be read without creating an account or providing personal information. Machine-readable contact details are at https://www.ultrahuman.com/.well-known/security.txt (RFC 9116).

This policy is established to support compliance with:

• UK Product Security and Telecommunications Infrastructure (PSTI) Regulations 2023
• ETSI EN 303 645 V2.1.1 Clause 5.2
• ISO/IEC 29147 (Vulnerability Disclosure)

This policy applies to:

• Consumer IoT devices manufactured or supplied by Ultrahuman
• Associated mobile applications
• Cloud platforms and backend services
• Web portals and APIs associated with the products
• Firmware and software components maintained by Ultrahuman

This policy covers vulnerabilities related to:

• Authentication bypass
• Unauthorized access
• Data exposure
• Privilege escalation
• Insecure communications
• Remote code execution
• Firmware or software vulnerabilities
• Cryptographic weaknesses
• Denial-of-service vulnerabilities
• Other cybersecurity weaknesses impacting confidentiality, integrity, or availability

Unauthorized testing activities and findings that are not eligible for acknowledgement are listed in section 8 (Out of Scope).

Researchers must not exploit vulnerabilities beyond what is necessary for validation, and must avoid destructive testing.

Denial-of-service vulnerabilities may still be reported. Do not demonstrate them against production systems.

Preferred contact is email. Reports in English are preferred. A PGP key is not currently published; do not wait for encrypted mail if that would delay a report.

Security vulnerabilities may be reported to:

• Primary email: security@ultrahuman.com
• Alternative email: feedback@ultrahuman.com
• Website: https://www.ultrahuman.com/security

Do not report vulnerabilities through public social media, support chat, or public issue trackers. Anonymous reports are accepted; include contact details only if you want a reply.

To help us validate and fix issues quickly, please include as much of the following as you can:

• A clear title and description of the issue.
• The affected asset: URL, endpoint, mobile app name and version, or device and firmware version.
• The relevant CWE identifier.
• A CVSS score using v3.1 or v4.0, including the full vector string and a short justification for the rating.
• Complete, numbered steps to reproduce.
• Proof of concept: relevant requests and responses, screenshots, or a short video.
• The impact, described as the realistic worst case for an attacker.
• Suggested remediation, if you have one.
• References, such as related CVEs, advisories, or documentation.
• Whether you would like to be credited on our acknowledgements page

Ultrahuman shall manage vulnerability reports according to the following timelines:

Where remediation requires additional time due to technical, supply chain, regulatory, or operational constraints, Ultrahuman will provide periodic status updates to the reporter.

Ultrahuman commits to:

• Reviewing all legitimate reports
• Treating reporters respectfully and professionally
• Working collaboratively toward remediation

Ultrahuman supports good-faith security research and will not pursue or support legal action against researchers who report vulnerabilities in accordance with this policy. We consider security research and vulnerability disclosure conducted under this policy to be authorized, lawful, and helpful to the security of our users.

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorized and we will not recommend or pursue legal action against you.

If at any point you are unsure whether your testing is consistent with this policy, contact us at security@ultrahuman.com before continuing.

Ultrahuman handles sensitive health data. Protecting our users' privacy is a condition of testing under this policy.

• Use only your own test accounts or accounts you have explicit permission to test. Do not access, modify, or interact with any other user's account or data.
• Do not access, download, store, retain, or transmit any personal data or health data belonging to any other individual.
• Access only the minimum amount of data necessary to demonstrate a vulnerability. Once you have confirmed an issue exists, stop.
• If you encounter any real user data, including personal or health data, stop testing immediately, do not save or copy it, and report it to us right away at security@ultrahuman.com. We will work with you to confirm the issue without exposing that data further.

The following activities and findings are not authorized under this policy and are not eligible for acknowledgement:

• Social engineering of Ultrahuman staff, users, contractors, or vendors, including phishing.
• Physical attacks against Ultrahuman offices, facilities, staff, or hardware, and theft or loss of devices.
• Denial-of-service, volumetric, resource-exhaustion, or rate-limit testing against production systems.
• Automated scanner output submitted without a demonstrated, exploitable impact.
• Findings that require a rooted, jailbroken, or otherwise compromised device, physical access to an unlocked device, or a machine-in-the-middle position that the user themselves would have to enable.
• Vulnerabilities in third-party services, platforms, or libraries that Ultrahuman does not own or operate. Report those to the relevant third party.
• Reports of missing best-practice hardening (for example, missing security headers, TLS configuration preferences, or email SPF/DKIM/DMARC) with no demonstrated security impact.

Please keep the details of any reported vulnerability confidential until we have resolved it. We ask that you allow us to remediate before any public disclosure, and that public disclosure happen only after we confirm a fix is in place. If you believe an issue poses an active, serious risk to users, tell us and we will work with you on an accelerated timeline.

The vulnerability management process includes:

• Receipt and registration of the vulnerability report
• Validation and technical assessment
• Risk classification using internal or industry-recognized severity methods (e.g., CVSS)
• Root cause analysis
• Remediation development
• Verification and regression testing
• Security update or mitigation release
• Coordinated public disclosure where appropriate
• Closure and documentation retention

Where applicable, Ultrahuman will provide remediation through:

• Firmware updates
• Software patches
• Configuration guidance
• Cloud-side mitigations
• Temporary workarounds
• Product advisories

Security updates shall be distributed using secure update mechanisms implemented within the product ecosystem.

Public disclosure of vulnerabilities may occur:

• After a fix or mitigation becomes available
• When sufficient remediation guidance exists
• In coordination with the reporting party
• When disclosure is necessary to protect customers

Security advisories may include:

• Affected products and versions
• Severity rating
• Description of impact
• Remediation instructions
• Mitigation guidance
• Acknowledgement of the reporter (where agreed)

Ultrahuman does not currently operate a paid bug bounty. Reports are still welcome.

Subject to mutual agreement, Ultrahuman may acknowledge responsible security researchers in:

• Security advisories
• Release notes
• Public acknowledgements

Information shared during vulnerability reporting shall be handled confidentially and used solely for cybersecurity remediation and product security improvement purposes.

Personal data shall be processed in accordance with applicable data protection and privacy laws.