Vulnerability Disclosure Policy (VDP)
Last update on: 2026/10/28
At INKBIRD we attach great importance to the cybersecurity of our connected products and services. We highly appreciate security researchers and the wider community for assisting us in discovering potential vulnerabilities, thereby helping us continuously fix issues and safeguard the digital security of our global users.
Return to Regulatory Compliance Page: To view the SoC declarations and support periods for each model, please visit the [Regulatory Compliance Center]
1. Product Scope and Compliance Boundaries
This policy applies to connected hardware products (including but not limited to smart home appliances, related firmware, and official companion mobile applications) developed, controlled, and sold directly by INKBIRD.
Disclaimer: This policy does not cover network infrastructure, routers, third-party services, or third-party mobile operating systems and applications not controlled by our company.
2. Password and Authentication Security
To strictly meet the baseline requirements of the UK PSTI and Australian cybersecurity legislation:
Smart connected products manufactured by our company do not use any universal default passwords upon factory reset or out-of-the-box.
During device provisioning and connected usage, encrypted transmission is employed to protect Wi-Fi provisioning information and device data. Furthermore, authentication and access control mechanisms are implemented to prevent unauthorized device access and data acquisition, ensuring network communication security.
3. How to Report Security Vulnerabilities
If you discover a potential security vulnerability in our products, we recommend that you contact our security team via the following dedicated email address:
Dedicated Security Email: support@inkbird.com
3.1 What to Include in the Report:
Product name and model (e.g., ISV-300W)
Application software version number (found in the INKBIRD app under "Me" > "About")
Product firmware version (found in the product settings under "Device Information")
Detailed description of the security vulnerability
Steps to reproduce the issue (including required network conditions, if applicable)
Product device ID, screenshots, packet captures, or logs (if applicable)
Whether the issue has been disclosed to any other parties (such as CERT, carriers, brokers, etc.)
Your contact information, along with your name or pseudonym (or you may choose to remain anonymous)
4. Our Response Process
Acknowledgement: You will receive an acknowledgement of receipt within 3 business days of submission.
Triage and Validation: Upon receiving your report, we will provide a preliminary assessment within 15 business days, stating whether the report has been validated, whether additional information is needed, or whether it falls outside our scope. During the preliminary assessment, we may contact you for further information or clarification.
Status Updates: We will provide you with a progress update every 30 days until the issue is resolved or confirmed not to be a valid security risk.
Vulnerability Remediation: We will promptly and properly handle confirmed vulnerabilities and notify you once the fix is deployed or the investigation is concluded.
5. Responsible Disclosure & Safe Harbor
We kindly request security researchers to:
Give us reasonable time to investigate and resolve vulnerabilities prior to public disclosure.
Avoid accessing, modifying, or deleting user data beyond what is necessary to demonstrate the vulnerability.
Make a best-effort approach to avoid privacy violations and service disruptions.
Refrain from using vulnerabilities for any malicious purposes.
Our Commitment:
Respond to all legitimate security reports in a professional and timely manner.
Keep you informed of the latest progress throughout the investigation.
Not take any legal action against researchers who adhere to the above responsible disclosure guidelines.