Policies

Security & Responsible Disclosure

How we protect our systems and client work, and how to report a security vulnerability to Modenic.

Last updated: October 24, 2026

Security is part of how we design and deliver software, devices, and infrastructure. This page summarizes our approach and explains how security researchers can report vulnerabilities in our website or systems.

1. How we work securely

Our standard practices include:

Least-privilege access to client systems and data, reviewed regularly and removed when no longer needed
Multi-factor authentication and managed, encrypted devices for all staff
Peer review, dependency scanning, and automated tests on every code change
Signed firmware, secure boot, and authenticated over-the-air updates for the connected devices we build
Secrets kept in dedicated vaults, never in source code
Security awareness training for everyone on the team

2. Client data

We process client data only as instructed in the relevant contract and data processing agreement, keep it in the environments agreed with the client, and return or delete it at the end of an engagement. We are happy to complete security questionnaires and discuss specific requirements before a project starts.

3. Reporting a vulnerability

If you believe you have found a security vulnerability in this website or another Modenic system, please contact us through our Contact page. Include a description of the issue, the steps to reproduce it, the affected URL or component, and any proof-of-concept code. Please do not report vulnerabilities through public channels or social media.

4. What we ask of researchers

When testing, please:

Give us reasonable time to fix the issue before disclosing it publicly
Only access the data needed to show the vulnerability, and do not keep, change, or share it
Avoid privacy violations, service disruption, and degradation of user experience
Do not use social engineering, phishing, physical attacks, or denial-of-service testing
Do not test systems that belong to our clients; report those directly to the client

5. What you can expect from us

If you follow these guidelines, we will:

Acknowledge your report within 3 working days
Keep you informed as we investigate and fix the issue
Not take legal action against you for research carried out in good faith under this policy
Credit you publicly once the issue is fixed, if you would like us to

6. Scope

This policy covers the Modenic website and systems operated by Modenic. Products and systems we build for clients are owned by those clients and fall under their own disclosure policies. We do not currently offer a paid bug bounty.

Modenic