Reporting a security problem

Use the report form at https://zero.aeronsystems.com/report-security?product=live3. It goes straight to the people who fix security problems.

Please tell us what you found and where (the web address, app screen or station), the steps to reproduce it, what an attacker could do with it, and how to reach you. Screenshots, logs or a short proof of concept help.

Please do not share the problem publicly until we have fixed it, and do not include other people's personal data in your report.

We will acknowledge your report within 2 business days.

Once we confirm a problem, we aim to fix it within these times: critical, 7 days; high, 30 days; medium, 90 days; low, the next scheduled release.

We will keep you informed while we work on it, and tell you when it is fixed.

We will not take legal action against you for security research done in good faith and within the scope below.

Good faith means you test only against your own account or data you are allowed to access, you stop and report as soon as you reach someone else's data, you do not change or delete data, and you do not disrupt the service (no denial-of-service, spam or social engineering of our staff or customers).

live3.aeronsystems.com, the Live3 apps for iPhone and Android, and the cloud services that Live3 monitoring stations send data to.

Other Aeron websites, third-party services we use, and physical access to stations are out of scope. If you are unsure, email us before testing.