Vulnerability Disclosure Policy

Report a security issue

This policy covers Headii devices, device firmware, the Headii App and related Headii services. Reports are handled by DOLLAR JUDGE INC, the company operating Headii.

Reporting is free. You do not need a Headii account, a purchase receipt, your real name, a phone number or an address. You may use an email address that does not identify you so we can reply and share progress.

You can report an issue whether you obtained your product through a store, crowdfunding campaign or another sales channel. This website does not need to process your purchase for us to receive your report.

The button opens your email application with an optional report template. Send the email to submit your report. If you use webmail, copy the address above and send your report there.

What to include

Share the information you have; the following details help us investigate:

• The affected product or service, and its software or firmware version if known.
• A description of the issue and its possible security impact.
• Steps to reproduce the issue, or a proof of concept if available.
• Optional screenshots, technical evidence or suggested mitigations.

Please remove personal data, passwords, authentication tokens and other secrets from evidence. Do not access another person’s data or disrupt services when investigating an issue.

Our response

We will acknowledge your report and provide initial feedback within 5 working days of receipt. Working days are Monday to Friday, excluding public holidays observed by our support team.

After acknowledging receipt, we will provide the first progress update within 10 calendar days and further updates at intervals of no more than 10 calendar days until the issue is resolved. We will share the current status even if there is no new progress. Calendar days include weekends and public holidays. If we need further information, we will explain what would help us investigate.

After assessing the issue, we will communicate its severity, the planned mitigation or fix, and the target remediation date. Timing depends on risk, complexity and any supplier dependencies. If the plan or target date changes, we will explain the change and provide an updated plan.

How we handle reports

1. Acknowledge: receive the report and assign it for investigation.
2. Assess: verify the issue, identify affected products and evaluate risk.
3. Remediate: develop a mitigation or fix and communicate the target timeline.
4. Verify and release: test the fix and provide an appropriate firmware update, app update or service change.
5. Follow up: inform the reporter of the outcome and review the effectiveness of the fix.

Coordinated disclosure and confidentiality

Please coordinate public disclosure with us so affected users can receive a mitigation or update before technical details are published.

We restrict access to reports to personnel who need the information to investigate and remediate the issue. We do not publish your contact information or unredacted report as part of a security announcement. Reports are used for security handling, not marketing subscriptions.

For security update support dates, see our Product Security Support Policy.