Skip to content

Coordinated Vulnerability Disclosure Policy

Optimo IoT values the work of independent security researchers in helping us keep the AL300 gateway and the Optimo IoT cloud platform secure. This policy describes how to report a suspected security vulnerability to us, what you can expect from us in return, and the rules under which we authorize good-faith security research.

Scope

In scope

  • AL300 (AssetLinker300) gateway: firmware, hardware, local web interface and local APIs
  • Optimo IoT cloud platform, including cloud.optimoiot.it, its web dashboard, and its public APIs (HTTP API, MCP server)
  • the OTA firmware update mechanism and update packages distributed by Optimo IoT
  • the VPN remote-access service provided through the platform

Out of scope

  • third-party field devices connected downstream of the gateway (PLCs, sensors, meters, etc.) that are not manufactured by Optimo IoT
  • the customer's own network, IT infrastructure, or physical premises
  • vulnerabilities that require physical possession of a specific customer's device, or that require credentials already known to an attacker (e.g. through the customer's own negligence), unless the finding demonstrates a way to obtain those credentials or that access without authorization
  • denial-of-service (DoS/DDoS) testing, load/stress testing, or any action that could degrade the service for other users
  • social engineering, phishing, or physical attacks against Optimo IoT staff, contractors or customers
  • automated vulnerability scanning of production systems performed without prior written coordination with security@optimoiot.it
  • reports based purely on best-practice recommendations, missing security headers, or software version disclosure without a demonstrated, concrete impact
  • issues already known to us or already publicly disclosed at the time of the report

If you are unsure whether something is in scope, report it anyway — we would rather review a borderline report than miss a real issue.

How to report

Send a report to security@optimoiot.it.

To help us triage and reproduce the issue quickly, please include:

  • the product/component affected (e.g. "AL300 local web interface", "Optimo IoT Cloud HTTP API") and, if known, the firmware or platform version
  • a description of the vulnerability and its potential impact
  • step-by-step instructions to reproduce it, including any proof-of-concept code, request/response samples, or screenshots
  • whether you believe the vulnerability is already being exploited or has been disclosed elsewhere
  • how you would like to be credited (or that you'd prefer to remain anonymous)
  • your contact details for follow-up questions

Please submit reports in English or Italian.

What you can expect from us

Step Target time
Acknowledgement of receipt within 3 business days
Initial triage and validation within 10 business days of acknowledgement
Status updates while the issue is open at least every 15 calendar days
Notification once a fix or mitigation is available as soon as it is released

Once validated, we assess severity using CVSS and target the following remediation timeframes, counted from validation:

Severity Target remediation time
Critical 30 days
High 60 days
Medium 90 days
Low 120 days, or at the next scheduled release

These are internal targets, not guarantees; complex issues (e.g. requiring a hardware revision) may take longer, in which case we will explain why and keep you updated.

Coordinated disclosure

We ask that you keep any vulnerability you report confidential, and do not disclose it publicly or to third parties, until:

  • we confirm a fix or mitigation has been made available to affected users, and
  • 90 days have passed since your initial report,

whichever comes first, unless we mutually agree in writing to a different disclosure date. If a vulnerability is already being actively exploited, we may need to ask for expedited public disclosure (e.g. a security advisory) before a full fix is available, together with interim mitigation guidance.

Safe harbor

Optimo IoT will not pursue legal action against, and will not report to law enforcement, researchers who:

  • make a good-faith effort to comply with this policy
  • only interact with accounts, devices and data they own or are explicitly authorized to test
  • do not access, modify, or exfiltrate data belonging to other customers beyond what is strictly necessary to demonstrate the vulnerability, and delete/report any such data immediately
  • do not disrupt production systems or degrade service availability for others
  • report the vulnerability to us promptly, and give us a reasonable opportunity to investigate and remediate before any public disclosure, as described above

This authorization does not extend to third-party systems, products or infrastructure not owned by Optimo IoT, even if reachable through our products; such findings should be reported directly to the relevant third party.

Recognition

With your consent, we will credit you by name (or handle) in the release notes or security advisory associated with the fix.

Changes to this policy

This policy may be updated from time to time; the version published on this page applies to reports submitted after the date of the latest change.