Responsible Disclosure Program

Responsible Disclosure Program

  1. Purpose
    Engineering Wireless Services (EWS) is committed to securing our wireless engineering solutions and protecting customer data. We invite security researchers to report vulnerabilities responsibly to help us maintain a secure ecosystem.
  2. Scope
    In-Scope:
    • Public-facing EWS systems
    • EWS APIs and backend services
    • EWS publicly available software and mobile applications
    • EWS customer portals

Out-of-Scope:
• Third-party vendor systems
• Marketing Sites
• Physical Security
• Any other services not explicitly included as “In-Scope” above

  1. Safe Harbor and Rules of Engagement
    General Guidelines:
    • No service disruption (DDoS, spam, resource exhaustion)
    • No data exfiltration beyond minimal proof
    • No social engineering or phishing
    • No physical attacks
    • Use test accounts whenever possible
    • Coordinate disclosure (90-day embargo or until fix confirmed)

SAFE HARBOR APPLIES ONLY TO GOOD-FAITH TESTING WITHIN SCOPE

  1. Vulnerability Classes of Interest

• Authentication / Authorization flaws
• Injection attacks (SQL, OS, LDAP)
• XSS
• SSRF, misconfigurations
• Secrets exposure

  1. Reporting Process
    Email security@engineeringwireless.com with:
    • Summary and impact
    • Steps to reproduce
    • Minimum Proof of Concept (PoC)
    • Environment details

What you can expect from us:

When you choose to share your contact information with us, we commit to coordinating with you as openly and quickly as possible:
• Within 3 business days, we will acknowledge that your report has been received.
• To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution.
• We will maintain an open dialogue to discuss issues.

  1. Questions

Questions regarding this policy may be sent to security@engineeringwireless.com We also invite you to contact us with suggestions for improving this policy.