Vulnerability Disclosure Policy

Coordinated Vulnerability Disclosure (CVD) Policy for iw.hub and Idealworks Orchestration System (Idealworks OS)

How we handle reports

Scope

This policy applies to vulnerabilities that could affect the confidentiality, integrity, availability, or safety of the following:

  • iw.hub (robot platform) — Onboard hardware and firmware/software developed or integrated by idealworks, including the IPC application stack, robot control and navigation software, and idealworks-developed configuration of onboard networking and safety-adjacent components.
  • Idealworks OS (Fleet Management System) — Idealworks' multi-tenant, cloud-hosted FMS: APIs, MQTT broker and messaging layer, web/operator applications, authentication and tenant-isolation controls, and supporting cloud infrastructure operated by Idealworks.
  • Interfaces between iw.hub and Idealworks OS — Device-to-cloud channels (MQTT, API, certificate/credential provisioning) connecting robots to the fleet management platform.
  • Idealworks corporate IT (in scope, lower priority) — Idealworks.com and other corporate web presences, to the extent a vulnerability could be leveraged against product security or customer data.

Out of scope / handle with care

  • Third-party components embedded within iw.hub or Idealworks OS that are subject to Cyber Resilience Act (CRA) compliance under their respective manufacturer's responsibility. Please also report these to the relevant upstream vendor; we welcome a copy so we can track it in our own component register and, where applicable, our supply-chain due-diligence process.
  • Denial-of-service testing, physical attacks against customer premises or robots in live operation, social engineering of idealworks staff or customers, and any testing that could endanger personnel given iw.hub is a safety-related machine.
  • Vulnerabilities in outdated/unsupported product versions no longer covered by an active support agreement.

How to report a vulnerability

If you believe you have found a security vulnerability in iw.hub, Idealworks OS, or any interface between them, please report it to us as follows:

  • Email: cybersecurity@idealworks.com, our monitored security contact address.
  • security.txt: https://idealworks.com/.well-known/security.txt per RFC 9116, pointing back to this policy and the contact above.

Please report a suspected vulnerability as soon as reasonably possible after discovery, and avoid sharing details publicly or with third parties until we have had the opportunity to investigate and remediate it.
Idealworks accepts vulnerability reports from all sources, including independent security researchers, customers, industry partners, suppliers and consultants. For the purposes of this policy, a vulnerability is a weakness, susceptibility or flaw in an Idealworks product with digital elements, or in an associated service, that could be exploited to compromise the confidentiality, integrity or availability of that product, its data or its functions.

What to include in a report

To help us triage and reproduce your finding quickly, please include as much of the following as you can:

  • A clear description of the vulnerability and its potential impact (e.g. what an attacker could achieve, and under what conditions).
  • The affected product, component, version/firmware, environment, or URL/endpoint.
  • Step-by-step reproduction instructions, including any tools, scripts, or requests used.
  • Proof-of-concept code, packet captures, screenshots, or logs, where available (please redact any personal data or customer data not necessary to demonstrate the issue).
  • Your assessment of severity and any relevant CVSS scoring, if you have one (not required).
  • Whether the vulnerability has already been disclosed elsewhere or assigned a CVE.
  • Your contact details.

Our commitment to you (Safe Harbor)

Provided you act in good faith and in accordance with this policy, IDEALworks will:

  • Not pursue or support legal action against you for security research conducted under this policy.
  • Work with you to understand and validate your report and keep the scope of any follow-up questions proportionate.
  • Acknowledge receipt and keep you informed of our progress


Good-faith security research under this policy means you:

  1. Avoid privacy violations, destruction of data, and interruption or degradation of our services.
  2. Only interact with accounts, data, and systems you own or for which you have explicit permission, or use test/demo environments where we provide them.
  3. Do not exploit a vulnerability beyond what is necessary to demonstrate it (e.g. no lateral movement, no exfiltration of customer data beyond a minimal proof).
  4. Give us a reasonable opportunity to remediate before any public disclosure.

Recognition

Idealworks does not currently operate a paid bug bounty program.

Report a vulnerability

Details on how we handle personal data are in our Privacy Policy.