Coordinated Vulnerability Disclosure Policy
Coordinated Vulnerability Disclosure Policy
Applicable Products: Hcalory diesel air heaters and companion APP
Version: v1.0
Effective Date: 2026-10-22
Next Review: 2027-10-22 (annually or after material changes)
Classification: Public
1. Purpose
This policy is established under the EU Cyber Resilience Act (Regulation (EU) 2024/2847), Annex I Part II, to provide security researchers, users, customers, and suppliers with a unified channel and process for reporting cybersecurity vulnerabilities in Hcalory products.
2. Scope
In scope
- Hcalory-branded diesel air heaters.
- Official iOS / Android APP (version ≥ 2.1.0).
- Vulnerabilities in third-party components integrated into the above products (report them to us and we will forward them upstream).
Out of Scope
- Models that have exceeded their support period and have been announced as EOL on the official website.
- Unofficial firmware and third-party modified devices.
- Physical destruction, theft, social engineering, phishing.
- Pure denial-of-service attacks (not involving a breach of the device security boundary).
- Vulnerabilities in the Hcalory website itself → may also be reported to security@hcalory.com, handled under this policy.
- Employee internal systems and suppliers' own platforms.
3. Reporting Channel
security@hcalory.com
Note: please do not report security vulnerabilities to the ordinary after-sales service mailbox, to avoid missing triage.
4. Report Content
- Product model + firmware / APP version
- Steps to reproduce
- Screenshots (sanitised)
- Your name and contact details
- Whether you plan to disclose and the expected timeframe
5. Our Response Commitments
| Stage | Timeframe |
| Acknowledgement of receipt | Within 5 business days |
| Initial validation and affected-version determination | Within 30 days |
| Risk rating and remediation scheduling feedback | Triaged by severity |
| Coordinated disclosure timing | Agreed with the reporter |
| Publish security advisory after remediation | Promptly after the update is available |
Severity is referenced to CVSS, but is ultimately judged against the actual integration environment (Bluetooth range, whether pairing is required, physical access, etc.).
6. Vulnerability handling process
1. Receive report → create ticket → acknowledge acceptance
2. Technical validation: reproduce and determine the affected firmware version
3. Risk assessment: likelihood × impact × exploitability
4. Remediation decision: OTA firmware / APP update/configuration change / temporary mitigation
5. Development + signing + testing
6. Deploy the update
7. Publish the security advisory (see Section 9)
8. For third-party components → notify the upstream maintainer
Security updates are provided free of charge during the support period.
7. Coordinated Disclosure and Embargo
- Report details are kept confidential by default until disclosure.
- We will not unilaterally rush to publish a PoC / exploit code.
- Disclosure timing is normally agreed with the reporter.
- If public disclosure could create widespread risk, full disclosure may follow after users have received the patch.
- The embargo period generally does not exceed a reasonable remediation cycle.
- Reporter attribution: acknowledged in the advisory's Acknowledgements section with your consent.
8. Safe Harbour
- Only testing devices you own.
- Not destroying, stealing, or tampering with other users' data.
- Not causing denial of service or affecting the operation of other devices.
- Reporting via security@hcalory.com and not disclosing details until remediation.
- Not circumventing physical locks or areas beyond the production-line encryption chip.
9. Security Advisories (public)
After a security update is released, we publish information about remediated vulnerabilities at:
https://hcalory.com/pages/security-advisories
- Vulnerability summary and identifier (internal ID + CVE if assigned)
- Affected model/firmware version
- Severity
- Mitigation measures
- Fixed version
- OTA / download method
Unremediated common CVEs are not mandatory to disclose; vulnerabilities that are actively exploited follow a separate CRA Article 14 regulatory reporting path.
10. Regulatory reporting
Only when a vulnerability is actively exploited, or a serious security incident occurs, will Hcalory submit a report to the ENISA Single Reporting Platform under CRA Article 14:
- Early warning within 24 hours
- Detailed notification within 72 hours
- Final report within 14 days after the fix is available
Ordinary research reports, internal penetration findings, and unexploited CVEs are not reported to the SRP; they are handled only in the internal vulnerability register.
11. Support Period
| Product | Support ends | Notes |
| Hcalory | 2030-12 | 5 years, or see the product page |
| Models Already EOL | See Announcement | Outside the scope of this CVD policy |
During the support period, we accept reports and assess remediation; beyond the support period, we only keep a record and do not promise a patch.
12. Non-public content
- Full cybersecurity risk-assessment draft
- Full SBOM (CycloneDX JSON)
- Architecture diagrams/trust boundaries
- Penetration test reports
- Rationale for accepted residual risk
- Full EU Declaration of Conformity
- ENISA reporting drafts
Provided to the competent authority on request under the CRA.
13. Contact
Security Reports: security@hcalory.com
CVD Policy: https://hcalory.com/pages/security
Security Advisories: https://hcalory.com/pages/security-advisories
After-sales (non-security): hcalory@hcalory.com
Version history v1.0 — 2026-10-22 — first published