Security
Lullawatch streams sound and pictures from a child’s room, so we treat every security report as urgent. Thank you for helping keep families safe.
Report a vulnerability
Email [email protected]. Please don’t post suspected vulnerabilities publicly.
Helpful to include: the affected part (iOS, Apple Watch, Android, Wear OS or web app, server, Local mode, Bluetooth, website) and version; what an attacker can do and what they need first; steps or a proof of concept; and whether you think it is being actively exploited. To encrypt your report, ask for a key in a short first email.
What happens next
| We confirm we received it | within 2 working days |
| First assessment | within 7 days |
| Fix for critical and high issues | as fast as possible, aim 30 days |
| Fix for medium and low issues | next regular release, aim 90 days |
| Public advisory and credit (if you want it) | after users can update |
We aim for coordinated disclosure, normally within 90 days. Actively exploited vulnerabilities and severe incidents are also reported to the authorities as the EU Cyber Resilience Act requires; we don’t share your identity without your consent.
Especially interesting
- Hearing, seeing or recording a baby unit without being approved on it
- Getting or keeping the encryption key after being removed or rejected
- Making a baby unit play sound, take a photo or start video for an unapproved device
- Silently stopping a parent unit from monitoring without an alert
- Weaknesses in pairing, check codes, QR pairing or guest access
Out of scope: volumetric denial of service, scanner output without a demonstrated impact, social engineering, physical access to an unlocked, already approved phone, and misconfigured self-hosted servers.
Safe harbour
We won’t take legal action against good-faith research that follows this policy: test only your own devices and your own self-hosted server, don’t access other families’ data, don’t degrade our public server, and tell us promptly.
Security updates
Security fixes go into the latest version of each app and of the server. Keep automatic updates on. Each Lullawatch product receives security updates until at least 31 December 2032. If we ever end support earlier for a product, we’ll say so here and in the app well in advance.