Reporting a security vulnerability to scOS
Smart City Operating System Limited (company number 13569571), trading as scOS, welcomes reports of security vulnerabilities in our products and services.
This policy is published so that anyone can report a security issue to us without asking first, in English, free of charge, and without giving us any personal information.
How to report
Use either channel. You do not need an account. You do not have to give your name or contact details.
- Form on this page: use the form below. It does not require your name or email address.
- Other contact methods: Contact Us.
Anonymous reports are accepted. If you want a reply, include a way to contact you.
You may also write to: Security reports, Smart City Operating System Limited, 4th Floor, Silverstream House, 45 Fitzroy Street, London W1T 6EB, United Kingdom.
What to include (optional, but helpful): the product, app or service affected; a description of the issue; steps to reproduce it; and any version, model or other identifier you have. Please write in English.
What we will do
- We will acknowledge your report within 5 working days of receiving it (if you have given us a way to reply).
- We will send you status updates at least every 30 days until the issue is resolved or we have reached a final position, and we will tell you when it is resolved.
- We will treat your report as confidential and use any contact details you choose to give only to handle the report.
A working day is Monday to Friday, excluding bank holidays in England and Wales.
Good-faith research
We will not take legal action against good-faith security research conducted within the scope of this policy.
In return, we ask that you:
- do not access or modify other users’ data;
- do not degrade our services or our customers’ systems;
- give us a reasonable opportunity to investigate and remediate before any public disclosure; and
- stay within the scope below.
If you would like to be credited once an issue is resolved, say so in your report. We will credit you unless you prefer to remain anonymous.
We do not operate a paid bug-bounty programme. We are grateful for good-faith reports.
Scope
In scope
- the scOS Intelligence Hub (the hardware and the firmware we supply)
- scOS mobile applications
- the website scos.co.uk
- scOS cloud services
Out of scope
- firmware of cameras (scOS does not manufacture, brand, supply or import cameras)
- physical attacks on customer premises
- social engineering of customers
scOS manufactures the Intelligence Hub only. We do not manufacture, brand, supply or import cameras. If your report is about a camera we did not supply, please also report it to that camera’s manufacturer. If the issue affects how a camera works with a Hub, we will still look at the Hub side.
This policy is not permission to attack systems that are not ours, to access anyone else’s data, or to test a customer’s home or network without their authorisation.
Security updates
We provide security updates for scOS Intelligence Hubs.
- For Intelligence Hubs we supply from 27 July 2026, the defined support period is until 31 October 2031.
- For Intelligence Hubs we already supplied before that date, the defined support period is until 30 June 2028.
That is the minimum length of time, with an end date, for which we will provide security updates. We may extend those dates; we will never bring them forward.
A Statement of Compliance has not yet been issued. When it is issued, it will state the defined support period that was correct when we first supplied the unit. We will send it to the customer. We will not wait to be asked.
This does not apply to cameras or other third-party equipment. scOS does not manufacture or brand cameras, and does not sell or import them as an scOS product. If a customer needs cameras, we arrange a third-party installer, who supplies, fits and bills the customer separately. The customer does not have to find an installer.
About this policy
This policy is published under Schedule 1, paragraph 2 of the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023. It is aligned with ETSI EN 303 645 V2.1.1 (19 June 2020) provision 5.2-1.
A machine-readable contact file is at https://scos.co.uk/.well-known/security.txt.
Published by Smart City Operating System Limited, 71 Manor Road, Caddington, Luton, LU1 4EE, United Kingdom.