Report a VulnerabilityCoordinated Vulnerability Disclosure Policy
1. Purpose
Shenzhen Omni Intelligent Technology Co.,Ltd is committed to the security of its products with digital elements and related services. We welcome good-faith reports of potential security vulnerabilities from customers, security researchers, partners, and other stakeholders. This policy explains how vulnerabilities can be reported securely and how we coordinate investigation, remediation, and disclosure.
2. Scope
This policy applies to security vulnerabilities affecting products and services developed, maintained, or operated by Shenzhen Omni Intelligent Technology Co.,Ltd, including but not limited to:
- https://www.omnismartiot.com/Products/
- Web services and online platforms operated by Omniiot
- Official mobile applications provided by Omniiot
- Official device firmware and embedded software for Omniiot products
The following are not within the scope of this policy:
- Third-party products or services not developed or operated by Shenzhen Omni Intelligent Technology Co.,Ltd
- Modified, unofficial, or unsupported software, firmware, or hardware
- Testing activities targeting systems, networks, or data that are not explicitly listed in this policy
3. Secure Reporting Channel
Our designated vulnerability-reporting contact point is the secure HTTPS form below:
https://www.omnismartiot.com/security/report
This form is intended for security vulnerability reporting, not general commercial inquiries or customer support. Reports may be submitted without identifying yourself, where technically supported. If you provide a contact address, we may use it for follow-up.
If the form is unavailable, vulnerabilities may also be reported via email: info@aiotomni.com
4. Information to Include
Where available, please provide:
- Affected product name/model and firmware or software version
- Clear vulnerability description and potential security impact
- Steps to reproduce, including prerequisites and test environment
- Relevant timestamps, configuration details, and sanitized evidence
- Your preferred contact information (optional)
Please avoid including passwords, private keys, personal information, or third-party confidential data unless strictly necessary and an appropriate secure exchange method has been arranged.
5. How We Handle Reports
Reports are accessible only to authorized personnel and are tracked under a unique reference number. Our security team will review the report, seek clarification when necessary, assess affected products and potential impact, and coordinate validation and remediation with relevant development and testing teams. Where contact information is available, we may acknowledge receipt and provide status updates.
We aim to acknowledge reports within 2 business days, complete triage and severity assessment within 7 calendar days, and keep reporters informed of significant progress. For confirmed vulnerabilities, our remediation targets are 30 days for critical, 60 days for high, and 90 days for medium severity issues (low severity issues are addressed in the next regular release). Where a fix is not feasible within these targets, we will communicate the revised timeline and rationale to the reporter. Security advisories are published for resolved vulnerabilities, normally upon or shortly after the release of the fix. These targets are operational goals and do not replace any applicable legal reporting deadlines under Regulation (EU) 2024/2847, including the 24-hour early warning and 72-hour reporting obligations for actively exploited vulnerabilities.
These targets are operational goals and do not replace any applicable legal reporting deadlines.
6. Coordinated Disclosure
We encourage reporters to coordinate public disclosure with us in order to reduce risks to users while the issue is being investigated and addressed. We will discuss appropriate disclosure timing where possible, taking into account severity, exploitability, availability of mitigations or updates, and applicable legal duties.
Where required, we will communicate information about fixed vulnerabilities and user remediation measures. We cannot guarantee a fixed remediation or disclosure timeline for every report.
7. Responsible Research Guidelines
We ask researchers to act lawfully and in good faith; use their own devices, accounts and data or obtain explicit authorization; limit testing to what is necessary to demonstrate the issue; avoid disruption, denial-of-service, destructive actions, persistence, social engineering, and access to other users’ data; and stop testing and report promptly if sensitive information is inadvertently accessed.
This policy does not grant authorization to test third-party systems or waive applicable laws. Any company commitment regarding legal safe harbor requires separate legal approval and should be stated explicitly if adopted.
8. Confidentiality and Personal Data
We restrict access to reports to personnel with a legitimate need to know and apply organizational and technical controls to protect submitted information. Information may be shared with relevant technical teams, affected suppliers, coordinating bodies, or authorities where needed for remediation or legal compliance.
9. Regulatory Reporting
Where a reported issue meets the criteria for mandatory reporting under applicable law, including Regulation (EU) 2024/2847 where relevant, Shenzhen Omni Intelligent Technology Co.,Ltd will assess and fulfill those obligations through designated official channels. Submitting a report through this form is not a substitute for a manufacturer’s separate regulatory notification duties.
10. Policy Maintenance and Contact Details
Policy updates will be published on this page. Last updated: 2026-10-30.