Vulnerability disclosure policy
If you find a security issue in Friolink, we want to know. This policy explains how to report it and what you can expect from us.
In effect since October 25, 2026. Contact also in /.well-known/security.txt (RFC 9116).
How to report
- Email [email protected] with the subject "Security", what you found, how to reproduce it and the impact you think it has.
- You can write in English, Spanish or Portuguese.
What we do
- We acknowledge receipt within 3 business days.
- We keep you updated while we fix it and tell you when it is resolved.
- If you wish, we credit you as the reporter when we publish the fix.
Good-faith research
- We take no legal action against good-faith research that follows this policy.
- Use only your own or test accounts. Do not access, modify or delete other people's data, and stop as soon as you confirm the issue.
- Do not disclose the vulnerability until it is fixed or 90 days have passed since your report, whichever comes first, unless we agree otherwise.
Scope
- In scope: friolink.com, login.friolink.com, the Friolink apps for Android and iPhone, the sensor firmware and Friolink Gateway.
- Out of scope: denial-of-service attacks, social engineering, physical testing, spam, and customers' equipment and networks.