This policy covers every repository of the IronFlock organisation and the products built from them: the IronFlock cloud platform, the IronFlock appliance, the device agent and device images, the SDKs and the dashboard widgets.

Please report vulnerabilities privately, not in public issues, pull requests or discussions.

• Email: security@ironflock.com
• GitHub: where a repository shows Report a vulnerability under its Security tab, you can use GitHub's private vulnerability reporting instead.

Please include what you can of:

• the affected product, component and version (or commit),
• the steps to reproduce, or a proof of concept,
• the impact you expect, and whether you know of active exploitation,
• how we can reach you, and whether and how you want to be credited.

• We confirm that we received your report within 5 working days.
• We assess it, keep you informed about our progress, and tell you when a fix is available.
• We agree a disclosure date with you. Once the fix is available, we publish an advisory and credit you if you wish.

When you look for vulnerabilities, please:

• use your own accounts, devices and data only, and never access, change or delete data of other users;
• avoid anything that degrades the service for others (no denial-of-service or load testing against the cloud platform);
• stop and report as soon as you have found a vulnerability, and do not use it further;
• give us reasonable time to fix the issue before you publish anything.

We will not pursue legal action against research that follows these guidelines in good faith.