Report a security issue
Email Thermetery Cybersecurity Team at vulns@thermetery.com with the subject Security report — [product name]. You do not need to be a customer or have a complete diagnosis to report a suspected issue.
Please report vulnerabilities privately before posting technical details in a public issue, forum, or social media. If the report includes sensitive material, send a brief description first so we can agree on a suitable way to share it. Do not send passwords, private keys, access tokens, or other people's personal data.
If you suspect active exploitation, a compromised download or update, or an immediate physical safety risk, make that clear at the start of your message. Stop using affected equipment if continuing could be unsafe; do not reproduce a fault that could injure someone or damage hardware.
What this covers
- Security vulnerabilities in software, utilities, libraries, and release packages that Thermetery develops or maintains.
- Firmware, BIOS modifications, embedded code, and update mechanisms that we develop or provide for our hardware or projects.
- Security weaknesses in hardware we develop, including interfaces, access controls, and interactions between hardware and software.
- Vulnerabilities in third-party components as used in a Thermetery product. Include the affected Thermetery product so we can assess the impact and coordinate with the component's maintainer where appropriate.
For ordinary bugs, compatibility questions, repairs, or project inquiries, use our general contact page. If you are unsure whether an issue is security-related, you are welcome to email the security contact.
What to include
Share what you know:
- The product or project name, software or firmware version, and hardware model or revision.
- Where you obtained it, such as a release link, repository, or download URL.
- A description of the issue, its likely impact, and any access or conditions needed to trigger it.
- Reproduction steps or a small proof of concept, with relevant logs or screenshots after removing sensitive information.
- Whether you have seen exploitation or disclosed the issue elsewhere, and how we can reach you.
Test only equipment and systems you own or have permission to assess. Avoid disrupting services, accessing other people's data, or changing or damaging their equipment. If you encounter unexpected sensitive data, stop and report what happened without collecting more.
How we respond
- Review and acknowledge. We review the report, acknowledge receipt as soon as practicable, and ask for any details needed to investigate.
- Assess the risk. We try to reproduce the issue, identify affected versions or hardware revisions, and assess exploitability, exposure, and potential safety impact. Active exploitation and serious user risk receive priority.
- Develop a response. Depending on the findings, we work on a software or firmware update, a configuration change, a workaround, or hardware-specific guidance. Where another supplier or maintainer is involved, we coordinate with them as needed.
- Share progress and guidance. We keep the reporter informed of material findings and next steps. When users need to act, we publish guidance through the relevant project's release notes, repository security advisory, or this website, identifying affected products and available fixes or mitigations.
Investigation and remediation time depend on the issue, product status, and any supplier dependencies. If a fix is unavailable or a product is no longer maintained, we explain that and share any available mitigation or replacement guidance. This page does not set a guaranteed response or resolution deadline.
Coordinated disclosure
We ask reporters to work with us on publication timing so affected users can take protective action. We discuss timing case by case, considering the severity, evidence of exploitation, and availability of a fix or mitigation. Urgent protective guidance may be needed before a complete fix is ready.
Please tell us whether and how you would like to be credited in any public advisory. We will confirm attribution with you before naming you.