CaIoT Responsible Disclosure Policy

Effective Date: November 27, 2023
Last Updated: July 6, 2026
Version: 2.0

1. Purpose

CaIoT encourages responsible reporting of security concerns. This Policy is incorporated into the Security Policy.

2. Reporting

Send vulnerability reports to [email protected] with enough detail to reproduce and assess the issue.

3. Rules

Do not access, modify, delete, exfiltrate, or disclose data without authorization. Do not disrupt services, perform denial-of-service testing, social engineer users, or test third-party systems without permission.

4. No Bounty Commitment

Unless CaIoT announces a formal bounty program, reporting does not create entitlement to payment, reward, employment, or public recognition.