Vulnerability Disclosure Policy

Effective date: 20th Oct 2026

  1. Purpose

    Fermax Asia Pacific Pte Ltd welcomes responsible reports of suspected security vulnerabilities affecting Fermax Asia Pacific Pte Ltd Smart Home (“VIDA”).

    These reports help us protect our users, their information and connected smart home systems.

     
  2. Scope

    This policy covers suspected vulnerabilities affecting VIDA applications, cloud services, gateways and firmware supplied or operated by us.

    Third-party products and services are outside this policy’s scope. Where appropriate, we may coordinate with the relevant provider.

    This policy provides a channel for reporting suspected vulnerabilities. It does not authorise security testing, exploitation or access to systems or data without permission.

     
  3. Responsible Reporting

    If you notice a suspected vulnerability:

    • Report it to us promptly.
    • Do not attempt to exploit, test, reproduce or further verify it.
    • Do not access or control another user’s account, home or connected devices.
    • Do not copy, download, alter, delete or share another person’s data.
    • Avoid any action that could disrupt services, damage systems or affect users’ safety.
    • Keep the details confidential while we investigate and coordinate any disclosure with us.

    If you accidentally encounter another user’s data or gain unintended access, stop immediately and report what you observed.

    All activities must comply with applicable laws, including Singapore’s Computer Misuse Act.

     
  4. How to Submit a Report

    Email to vida@fermax.com.sg with the subject:

    VIDA — Suspected Security Vulnerability

    Please include, where available:

    • A description of the suspected issue.
    • The affected application, device, service or URL.
    • The application or firmware version.
    • When and how you first observed the issue.
    • Its potential impact on users, data or services.
    • Existing screenshots or evidence, with personal data and credentials removed.
    • Your email address so we can contact you for clarification.

    Do not perform additional testing to prepare your report. If evidence contains sensitive information, contact us first to arrange a secure way to provide it.

     
  5. How We Handle Reports

    We aim to acknowledge reports within three business days.

    We will assess each report, coordinate with relevant technical teams or service providers, and prioritise confirmed vulnerabilities according to their severity and potential impact.

    Where contact details are available, we will provide reasonable progress updates. Resolution time depends on the complexity of the issue and any third-party involvement.

     
  6. Public Disclosure

    Please do not publish or share vulnerability details publicly before the issue is resolved. Early disclosure could put users and their homes at risk.

    If you wish to publish your findings, contact us to coordinate the timing and content of disclosure.

     
  7. Rewards and Legal Position

    This programme does not offer financial rewards or reimbursement of expenses.

    Submitting a report does not grant permission for unauthorised activities or provide immunity from applicable laws. Acknowledging a report does not mean that we have confirmed the vulnerability.

     
  8. Personal Information

    We use information submitted with a report to investigate the issue, communicate with the reporter and coordinate remediation. Relevant information may be shared with technical teams or service providers assisting with the investigation.

    Personal data will be handled in accordance with our Privacy Policy.