Vulnerability Disclosure Policy

Report potential security vulnerabilities in FanX Drive products by email. We acknowledge reports within 2 business days and provide updates at least every 90 business days until the issue is resolved.

You can use this contact to report security issues involving any FanX Drive product, for example vulnerabilities in the device system, firmware, or FanX Cloud software or services used for or in connection with the product's intended use. If you are unsure whether an issue is in scope, please report it; we will review it and direct it to the appropriate team.

Send your report to security@fanxcloud.com with the subject line “FanX Drive security report”. You can read this policy and find the reporting address without an account, payment, prior request, or providing personal information. Reporting does not require a name, account, or proof of purchase.

Suggested Email Format

Copy this template into your email and complete the fields you have information for. Leave unknown fields blank.

Subject: FanX Drive security report

• Issue title: [brief description of the vulnerability]
• Affected product / version: [model and firmware/software version, if known]
• Issue and impact: [what occurs and the potential security impact]
• Steps to reproduce: [reproduction steps or conditions, if known]
• Evidence (optional): [screenshot or minimal supporting proof]

Please redact all passwords, access tokens, and third‑party personal data. If sensitive material is required to demonstrate the issue, summarise the details first, and we will coordinate a secure sharing method.

Receipt acknowledgement: You will receive confirmation within 2 business days after we receive your report.
Status updates: We will provide updates at least every 90 business days until the reported issue is resolved.

For this policy, business days are Monday through Friday.
We will share progress updates even while investigation or remediation is in progress, and notify you when the issue is fully resolved.
These are communication response targets only. The time required to implement a fix varies based on the vulnerability’s impact and complexity.

1. We acknowledge receipt and may ask for details needed to reproduce the issue.
2. We verify the issue, assess its impact and affected versions, and plan a fix or mitigation.
3. We work on the fix, keep the reporter informed, and verify the outcome.
4. When users need to act, we may publish a security advisory with affected versions and available updates or mitigations.

Please report a potential vulnerability privately and allow time for us to investigate and prepare a fix or mitigation before publishing technical details. We will coordinate disclosure timing with you where possible. We may acknowledge your contribution publicly with your consent.

Limit testing to devices, accounts, and data you own or are authorised to use. Avoid service disruption, social engineering, accessing other users' data, or changing or deleting data. If you encounter sensitive data, stop testing and tell us through the reporting address. This policy does not grant permission to test systems without the owner's authorisation.

Find the minimum security update period for each listed FanX Drive model.

View support periods →