Reporting a vulnerability

Found a vulnerability in HydroCommander, in the device, the app, the cloud service or this website? Please write to info@stemp-systems.de (German or English).

Helpful details: the affected product and version (firmware version on the device: Settings → System settings → Info & update), a description and steps to reproduce, the possible impact, and whether it is being exploited.

What you can expect from us

• We acknowledge within 5 working days and give a first assessment within 10 working days.
• We keep you informed and agree on the disclosure date with you, normally once the update is available, at the latest after 90 days unless agreed otherwise.
• We credit reporters on request.
• Good-faith research under these rules will not face legal action from us; please only access your own devices and accounts, do not modify or delete others' data and do not disrupt others.
• We do not pay bug bounties.

Security updates

Security updates are provided free of charge for at least five years from delivery; they are offered through the app and the device. Fixed vulnerabilities are published with the release notes. Actively exploited vulnerabilities are reported to the competent authorities (CSIRT, ENISA) as required by law.

Machine-readable: /.well-known/security.txt (RFC 9116).