DataRemote, Inc.
Vulnerability disclosure program on security.txt dataremote.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
This is not a bug-bounty program. DataRemote does not currently offer monetary compensation for vulnerability reports unless agreed to in writing before testing begins.
- Response
-
Within 3 days
Acknowledge receipt within three business days;
- Safe harbor
-
Full
When you conduct security research in good faith and comply with this policy, DataRemote will consider that research authorized and will not initiate legal action against you for the research.
- Hall of fame
-
Yes
Credit you publicly if you request recognition and DataRemote determines that disclosure is appropriate.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 8 excluded.
Web 2
- https://dataremote.com
- https://static.dataremote.com
Products and areas 2
- its products, firmware, APIs, and the Ara device-management platform
- Other public systems that DataRemote identifies in writing as being in scope
Out of scope (8)
- Cellular networks, carrier infrastructure, SIM services, private APNs, or telecommunications networks
- Customer, reseller, distributor, partner, government, or carrier systems
- DataRemote employees, contractors, offices, or physical facilities
- Devices deployed at customer sites or in active field installations
- Fire alarm, burglar alarm, elevator, emergency calling, E911, life-safety, or monitoring systems
- Microsoft 365, SendGrid, Cloudflare, Pipedrive, or other third-party platforms and services
- Production Ara device-management infrastructure or another user’s account
- Third-party integrations, even when accessible through a DataRemote webpage or hostname
Rules
What the policy asks of you, and the bug types it won't reward, quoted from DataRemote, Inc.'s policy.
While testing
-
Act in good faith and take reasonable steps to avoid harm;
-
Use only accounts, devices, and information that you own or are authorized to use;
-
Limit testing to the minimum necessary to confirm the vulnerability;
-
Stop immediately if you encounter personal information, confidential information, credentials, customer data, or evidence of active compromise;
-
Do not retain, transmit, or disclose data obtained unintentionally;
-
Notify DataRemote promptly if a vulnerability presents an immediate risk to customers, public safety, or system availability;
-
Preserve enough information to help DataRemote reproduce and correct the issue without collecting unnecessary sensitive data.
-
Denial-of-service, distributed denial-of-service, load, or stress testing;
-
Social engineering, phishing, impersonation, or physical intrusion;
-
Password spraying, credential stuffing, or testing credentials obtained from a breach;
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.