Moduel builds connected products for the home. We take reports of security problems seriously, and we would rather hear about one from you than read about it later.

Reporting a vulnerability

Email security@moduel.com.

Please include enough for us to reproduce the problem: the product or service affected, the version or firmware you were using, what you did, and what happened. Proof-of-concept code, screenshots or packet captures all help. Write in English or Swedish.

If you believe the issue is being actively exploited, say so in the subject line.

What we will do

• Acknowledge your report within 3 working days.
• Give you an initial assessment within 10 working days, telling you whether we have reproduced the issue and how we rate its severity.
• Keep you updated at least every 30 days until the issue is closed.
• Aim to release a fix within 90 days of acknowledging a confirmed vulnerability. Where a fix will take longer, we will tell you why and agree a date with you.
• Credit you in the release notes or on this page if you would like us to, once a fix is available. Tell us the name you would like used.

We do not operate a paid bug bounty programme.

Scope

Reports are welcome on anything we make or run:

• The Moduel Home App for iOS and Android
• The Moduel Gateway
• The Smart Matter Control Module F1
• Moduel web services, including moduel.com and the Moduel customer and partner portals

Out of scope

These are not things we will treat as vulnerabilities:

• Reports produced only by an automated scanner, with no demonstrated impact
• Missing security headers, cookie flags or TLS configuration with no working attack behind them
• Denial of service, volumetric or resource-exhaustion testing
• Social engineering of our staff, customers or suppliers, and physical attacks on our offices
• Vulnerabilities in third-party platforms we do not control, such as the app stores or our payment provider. Please report those to the party concerned.
• Attacks requiring a physically disassembled device and laboratory equipment, unless they yield a secret shared across devices

What we ask of you

• Give us a reasonable chance to fix the issue before telling anyone else. We will work to the 90 days above, and we will not ask you to stay quiet indefinitely.
• Use only your own accounts and your own devices. Do not access, modify or delete anyone else's data.
• Stop as soon as you have shown the problem exists. Do not go further into a system than you need to in order to demonstrate it.
• Do not run denial-of-service tests, send spam, or degrade service for others.

If you follow these, we will not pursue or support legal action against you for your research, and we will say so to anyone who asks.

How long products receive security updates

We provide security updates for the Moduel Home App for as long as it is published in the app stores. We provide security updates for the Moduel Gateway and the Smart Matter Control Module F1 for at least five years from the date the product was last sold as new. We will publish the end of that period on this page before it arrives.

This page

Our machine-readable contact details are published at https://smarthome.moduel.com/.well-known/security.txt