Reporting a security vulnerability
Security researchers and customers sometimes find vulnerabilities in Wattch's systems before we do. This page explains how to report one, what testing is allowed, and what you can expect from Wattch in return.
What is in scope
- The Wattch web application at app.wattch.io
- Wattch's public APIs
- Wattch's public websites
- The Wattch Edge Controller and its firmware, tested on a bench by a customer who owns the device, with the device not connected to equipment at a live site
What is out of scope
- Equipment at customer sites, including any Wattch Edge Controller that is controlling a site and the inverters, meters, batteries, and other devices connected to it. These control live energy assets, and interfering with them can cause physical harm or financial loss to the site owner.
- Third-party services Wattch uses, such as Google Cloud Platform, GitHub, and Slack. Report vulnerabilities in those services to the vendor.
- Accounts or data that belong to anyone other than you.
How to report a vulnerability
Email support@wattch.io with:
- a description of the vulnerability and where it is
- the steps to reproduce it
- what an attacker could do with it
- your name or handle, if you want credit
Do not include customer data in your report. If you came across any while testing, say so and describe it, but do not send it.
Testing rules
When testing Wattch's systems, you must:
- test only against your own accounts, or accounts you have permission to use
- stop as soon as you reach data that is not yours, and not copy, keep, or share it
- not run denial-of-service tests, automated scans that degrade service, or tests that send large volumes of traffic
- not attempt social engineering, phishing, or physical access against Wattch, its personnel, or its customers
- not send commands through the Wattch platform to equipment at any customer site, and never interfere with an Edge Controller that is controlling a site
- keep the vulnerability confidential until Wattch has fixed it or 90 days have passed since your report, whichever comes first
What Wattch commits to
- We acknowledge each report within 3 business days.
- We tell you whether we have confirmed the vulnerability and, if so, when we expect to fix it.
Wattch does not pay bounties.
