Security Policy

If you found a security vulnerability in an Emteria product, please report it to us. We will be happy to work with you to fix it before details become public.

Scope

This policy covers:

• Android OS built by Emteria, including customer-specific builds based on it
• Emteria apps on these builds, such as Emteria License, Kiosk, MDM and the OTA Update Client
• the Emteria Hub, its APIs and our other cloud services
• the website https://emteria.com and its subdomains

We also accept reports about upstream components, such as AOSP, the Linux kernel or vendor drivers, if they affect a build by Emteria. We will coordinate the fix with the upstream maintainer. Issues in device hardware or proprietary firmware that we don't build, such as BIOS, UEFI or vendor bootloaders, belong to the device manufacturer. We forward such reports where we can.

How to report

Email security@emteria.com in English or German. Please include:

• the affected product, its version or build number, and the device model
• a description of the vulnerability and its impact
• steps to reproduce it, or a proof of concept
• whether the vulnerability is already public or known to be exploited

Please don't report vulnerabilities in public channels such as forums, social media or public issue trackers.

What you can expect

• We confirm receipt of your report within 5 business days.
• We keep you informed about our assessment and the progress of the fix.
• We aim to release a fix and disclose the vulnerability within 90 days of your report. Some fixes need longer, for example when device makers have to roll them out to their fleets. In that case, we agree on a later date with you.

Coordinated disclosure

Please don't publish details before the agreed date. When we release the fix, we describe the vulnerability in our release notes and credit you by name if you wish.

Android OS built by Emteria runs on devices of many manufacturers. If a vulnerability affects their devices, we share the details they need with them, so they can inform their users. Where the law requires it, for example the EU Cyber Resilience Act, we report actively exploited vulnerabilities to the competent authorities.

Safe harbor

We will not take legal action against you for security research that you do in good faith and in line with this policy. Please:

• test only on devices and accounts that you own or have permission to test
• access no more data than you need to show the vulnerability, and don't change or delete data
• don't disrupt our services: no denial-of-service tests, spam or automated mass scanning
• don't use social engineering, phishing or physical attacks
• delete any data you obtained once we have closed your report

This safe harbor doesn't cover claims by third parties, such as our customers.

Bug bounty

We don't run a paid bug bounty program.

Machine-readable information

Our contact details are also available in machine-readable form at /.well-known/security.txt (RFC 9116).