Security & Vulnerability Disclosure

Report a Security Vulnerability

We take the security of Monitoreal devices, apps and services seriously. If you believe you have found a security vulnerability in any Monitoreal product, please tell us privately — we will work with you to resolve and protect you and our users.

What this policy covers

  • Monitoreal hardware: Spartan series, Zeus, intercoms, IP speakers and other devices
  • Device firmware and the Monitoreal AI software running on them
  • Monitoreal Desktop Guard and mobile apps
  • Monitoreal cloud services and APIs
  • monitoreal.com and its subdomains

Out of scope

  • Third-party products and services not developed by Monitoreal (please report those to the vendor)
  • Denial-of-service, spam or social-engineering attacks against Monitoreal staff or customers
  • Physical attacks that require unrestricted access to a device
  • Findings from automated scanners without a demonstrated security impact

Report privately

Use the form, or email mrsupport@monitoreal.com with the subject “Security vulnerability”.

Please do not report security issues through public channels such as social media, forums, product reviews or GitHub issues.

When you will hear from us

We acknowledge receipt within 5 business days and provide a substantive response within 10 business days.

Other ways to report

Email: mrsupport@monitoreal.com
Post: Monitoreal Limited (HQ), Attn: Product Security, 203 Charalambou Pettemeride 8 str, 7060 Livadia, Larnaca, Cyprus

You can also report directly to CSIRT-CY, the national CSIRT of Cyprus.

Please include

  • Affected product, model and firmware / app version
  • Type of issue (e.g. authentication bypass, remote code execution, data exposure)
  • Step-by-step instructions to reproduce
  • Impact: what an attacker could achieve
  • Proof of concept, logs or screenshots (you can share links in the form; we’ll ask for files by email if needed)
  • Whether you believe the issue is being actively exploited

01 · Affected product

Helps us assess our EU reporting obligations.

02 · The vulnerability

Technical details
Links to a video, screenshots or a PoC. Please don’t upload files — we’ll ask for them by email if needed. Please don’t share real recordings showing identifiable people — redact them or describe the issue instead.

03 · Exploitation and urgency

Is there any sign that the vulnerability is being exploited?
Already publicly known?
Public exploit available?
Already reported elsewhere?

04 · About you

Anonymous reporting is possible.
Anonymous report
We’ll use it only to communicate about this report.
Updates

05 · Disclosure and credit

Preferred time until publication
Credit in our Hall of Fame
Anonymous reports can only be credited under a pseudonym.

06 · Consent

Data protection

We will not take legal action against you for good-faith research — see our policy above.

What happens next

1

Acknowledgement — within 5 business days

We confirm we’ve received your report and provide a reference number.

2

Assessment

We reproduce the issue, rate its severity (CVSS) and keep you informed of progress.

3

Fix

We develop, test and then release any fixes as a free security update. We aim to resolve confirmed vulnerabilities within 90 days, whereas any critical issues are immediately prioritised.

4

Disclosure

Once a fix is available we publish a security advisory and, with your permission, credit you in our Hall of Fame. We ask that you do not disclose the issue publicly before then — we will agree a disclosure date with you.

Regulation (EU) 2024/2847

Our obligations under the EU Cyber Resilience Act

Monitoreal Limited handles vulnerabilities in line with Regulation (EU) 2024/2847 (Cyber Resilience Act):

  • If a vulnerability in our products is actively exploited, or a severe incident affects their security, we notify the Cyprus national CSIRT (CSIRT-CY) and ENISA through the EU Single Reporting Platform — an early warning within 24 hours, a notification within 72 hours and a final report after a fix is available.
  • We inform affected users about the issue and the steps they should take, by email, in the Monitoreal app and on our Security Advisories page.
  • Security updates are provided free of charge for the support period of each product.

Good-faith research

We will not take legal action against you for security research that follows this policy. Please:

  • Only test against devices and accounts you own or have permission to test
  • Do not access, modify or delete other users’ data or video
  • Stop and report as soon as you confirm a vulnerability
  • Do not degrade our services or use the vulnerability beyond what is needed to demonstrate it
  • Give us reasonable time to fix the issue before disclosure

We do not run a paid bug bounty program. We are grateful for every valid report and, with your permission, credit researchers in our Hall of Fame.

How we handle your report

We use your email address, optional name and the technical details you send only to investigate and fix the reported issue, to communicate with you about it, to meet our legal obligations under the Cyber Resilience Act and — if you agree — to credit you in our Hall of Fame.

Technical details may be shared with the Cyprus national CSIRT and ENISA where the law requires it. We keep reports for up to 5 years after the issue is closed.

To ask about or delete your data, email mrsupport@monitoreal.com.

Security Hall of Fame

We thank the following researchers for responsibly disclosing security issues:

No entries yet — be the first.

Security contact: mrsupport@monitoreal.com · Machine-readable: security.txt · Last updated: October 2026