HIGH RISK01
Critical security issues
Vulnerabilities that may lead to remote code execution, data breaches or other serious exploits. Immediate action is required.
ExamplesRemote code execution, privilege escalation, data leakage
ECOAIR · PRODUCT SECURITY
Protecting your products.
Protecting your trust.
EcoAir App Security & Vulnerability Disclosure Policy
At EcoAir, we place a high priority on the security and integrity of our products. We're committed to transparency and to addressing identified vulnerabilities promptly. Explore how to report a concern, how issues are prioritised and our approach to updates.
01 / REPORT A VULNERABILITY
Help us keep EcoAir secure.
If you discover a possible vulnerability in an EcoAir product, we encourage you to report it. No login is required to use our vulnerability submission form.
Providing clear information helps our team assess and investigate the issue.
Open vulnerability submission formThe form opens on our external submission service.
What to include in your report
- Vulnerability descriptionA brief explanation of the issue and what happens.
- Affected product / versionWhich EcoAir product and software version are affected.
- Severity levelChoose High, Medium, Low or Neglect.
- Attachments (optional)Screenshots or supporting files, if available.
02 / RISK CLASSIFICATION
How we classify vulnerabilities.
Each report is assessed by its potential impact to help us prioritise our response.
MEDIUM RISK02
Significant potential impact
Issues that present significant risk but are not immediately exploitable and are addressed in a timely manner.
ExamplesDenial of service, authentication bypass, potential privilege escalation
LOW RISK03
Minor security concerns
Issues that do not present an immediate security risk, including minor and non-critical defects.
ExamplesMinor user-interface bugs, non-security-related issues
NEGLECT04
No immediate action needed
Issues that do not affect functionality or security and do not require immediate action.
ExamplesCosmetic bugs, outdated content
03 / OUR TIMEFRAMES
Response & repair times.
We prioritise reported vulnerabilities according to severity. The timeframes below are expressed in working days.
High severity
PRIORITY3 working daysAcknowledge & begin investigation
5 working daysImplement fix after acknowledgement
Medium severity
5 working daysAcknowledge & begin investigation
10 working daysImplement fix after acknowledgement
Low severity
10 working daysAcknowledge & begin investigation
15 working daysImplement fix after acknowledgement
The policy does not specify response or repair targets for the Neglect category. Repair timeframes above are measured from acknowledgement.
04 / RESOLUTION PROCESS
From report to resolution.
Our five-stage process is designed to assess, resolve, verify and release appropriate security fixes.
- 01
Acknowledgement
We acknowledge the report and assign it to the appropriate team for analysis.
- 02
Investigation
Our security team investigates the issue, assesses its impact and determines a resolution.
- 03
Fix implementation
Once the investigation is complete, the necessary fixes and security patches are implemented.
- 04
Verification
The fix is tested to confirm that the vulnerability has been addressed and no new issues have been introduced.
- 05
Release
The verified fix is included in the appropriate software release, and affected users are notified of the patch.
05 / PRODUCT SOFTWARE SUPPORT
Security update support.
Review the published software support dates for the EcoAir models listed below.
SECURITY UPDATE EOL01 SEP 2030For all models listed below
| Product SKU | Model name | Launch date | Security update EOL date |
|---|---|---|---|
| AS-100002 | AVS MK2 | 1 Sep 2024 | 1 Sep 2030 |
| SA-100011 | IQ | 1 Sep 2024 | 1 Sep 2030 |
| DC-100021 | Apex 12L | 1 Sep 2024 | 1 Sep 2030 |
| DC-100022 | Apex 18L | 1 Sep 2024 | 1 Sep 2030 |
| DC-100023 | Apex 26L | 1 Sep 2024 | 1 Sep 2030 |
| AP-100004 | Pure 400 | 1 Sep 2024 | 1 Sep 2030 |
| DD-100027 | DD3 Slimline | 1 Sep 2024 | 1 Sep 2030 |
| DD-100026 | DD3 Classic MK4 | 1 Sep 2024 | 1 Sep 2030 |
| DD-100028 | DD2 Simple WIFI | 1 Sep 2024 | 1 Sep 2030 |
| DDW-100000 | DDW10 WIFI | 1 Sep 2024 | 1 Sep 2030 |
| DDW-100003 | Piccola WIFI | 1 Sep 2024 | 1 Sep 2030 |
| PAC-100021 | Apollo 10k Cooling + Wifi | 1 Sep 2024 | 1 Sep 2030 |
| PAC-100022 | Apollo 12k Cooling + Heating + Wifi | 1 Sep 2024 | 1 Sep 2030 |
No matching products. Try a different model name or SKU.
The dates shown above are the published product software support dates in EcoAir's policy.
06 / GET IN TOUCH
Have a security question?
If you need help or further information about this policy, our EcoAir support team is available to assist.
Thank you for helping EcoAir maintain a secure environment for all users.