Security
Report a vulnerability
If you believe you have found a security vulnerability in a Backbone product — the Backbone controller, its firmware, the Backbone app for iOS or Android, or our backend services — please email security@playbackbone.com.
Please include: the product and version affected, steps to reproduce, and the impact you believe the issue has. We will acknowledge your report within 3 business days and keep you informed as we investigate.
Our disclosure policy
- We will not take legal action against researchers who report vulnerabilities to us in good faith, make a reasonable effort to avoid privacy violations and service disruption, and give us a reasonable time to remediate before public disclosure.
- We ask that you do not access or modify other users' data, and do not run automated scanning that degrades our services.
- We will credit reporters in our advisories unless you prefer to remain anonymous.
Security advisories
We publish advisories for security issues affecting Backbone products, including any corrective actions you should take, on our Security Advisories page. For issues that require you to act (such as installing a firmware update), we also notify you through the Backbone app.
Security updates
Backbone products receive security updates automatically: the Backbone app through the App Store and Google Play, and controller firmware through the Backbone app. Keeping the app up to date ensures you receive firmware security updates. We provide security updates for our products for 3 years from purchase.
Machine-readable contact
See our security.txt (RFC 9116).
