EngineersM8 Ltd, trading as Engineer M8, welcomes reports of suspected security vulnerabilities in our connected devices, firmware, applications and online services. A security vulnerability is a weakness that could allow unauthorised access, expose information or affect the safe and reliable operation of a product.
How to report a vulnerability
Email hello@engineerm8.com with the subject Security vulnerability report. You do not need a customer account, support contract or active subscription to report an issue. Please provide a reply address if you would like acknowledgement and progress updates.
Include the product name and model, hardware revision and software or firmware version where available; a description of the weakness and its possible impact; the steps needed to reproduce it; and the date you discovered it. Screenshots, redacted logs and a minimal proof of concept can help. Tell us if you believe the issue is being actively exploited.
Do not email passwords, API keys, customer footage or other sensitive personal information. If sensitive evidence is necessary, contact us first so we can agree an appropriate transfer method.
Our response times
We will acknowledge receipt within 2 working days. We will provide an initial assessment or progress update within 10 working days of receipt and further status updates at least every 10 working days until resolution. Working days are Monday to Friday, excluding public holidays in England and Wales.
We assess the affected products, severity, likelihood of exploitation and potential customer impact. We prioritise critical issues and evidence of active exploitation. Where appropriate, we will provide interim steps to reduce risk while a fix is developed and tested. Resolution times depend on the issue; we will explain the next steps, expected timescale where known and any material delays.
Investigation and resolution
We will investigate reports, request clarification where needed and coordinate with affected suppliers. Resolution may involve a software update, configuration change, mitigation or an explanation that the issue is not a vulnerability or is outside our control. We will tell the reporter the outcome and provide relevant guidance for affected customers.
We accept reports about older products and third-party components used with our products. The availability of updates depends on the product’s published support period and the responsibilities of the relevant manufacturer.
Responsible research and coordinated disclosure
Only test devices, accounts and systems you own or have explicit permission to test. Do not access or retain other people’s data, disrupt services, use social engineering, damage equipment or change safety-critical settings. Stop testing and contact us if you encounter personal data or a risk of harm.
Please give us a reasonable opportunity to investigate and address the issue before publishing details that could expose customers to harm. We will work with you on an appropriate disclosure date and, with your permission, researcher acknowledgement. This policy does not authorise access to third-party systems and does not create a paid bug bounty programme.
Privacy and contact
We use report information to investigate, resolve and communicate about security issues, sharing necessary details with relevant suppliers where appropriate. Personal information is handled in accordance with our Privacy Policy.
Policy owner: Engineer M8 technical management. EngineersM8 Ltd, 15 Neptune Court, Vanguard Way, Cardiff, CF24 5PJ.
See also our Software Security Updates and Support Periods policy.