Vulnerability Disclosure Policy

Flock builds technology that public safety agencies, private organizations, and communities rely on. We take the security of our products seriously, and we welcome reports from security researchers who help us find and fix vulnerabilities.

This policy explains how to report a security vulnerability to us, what we will do when we receive your report, and what we ask of you in return.

Scope

This policy applies to all Flock products and services, including our hardware devices, embedded software and firmware, mobile and web applications, and cloud services.

Anything not explicitly stated as in-scope is considered out-of-scope in this policy.

Some services that carry Flock branding are operated by third parties on our behalf, including store.flocksafety.com. Those are outside the scope of this policy. If you find an issue in one of them, tell us and we will route it to the appropriate party.

Use of AI / LLMs in vulnerability research

You may use AI assistants, large language models, and automated scanners as part of your research. We have no objection to how you find a vulnerability.

However, every submission must stand on its own without reference to those tools. Specifically, each report must include:

• A concrete, reproducible proof of concept — the exact request, payload, steps, or code needed to trigger the issue against our systems.
• Evidence you observed directly: raw HTTP requests and responses, logs, screenshots, or stack traces. Not a description of what a tool said would happen.
• The specific affected endpoint, parameter, host, or component.
• An impact assessment you can defend in your own words. If we ask follow-up questions, you should be able to answer them without going back to a model.

We will close any report that is a summary of tool output, cites CVEs or advisories that do not apply to the version or configuration in use, references documentation or research that does not exist, or describes theoretical behavior that has not been verified against a live target. 

Do not submit unmodified scanner or model output as a report body.

Finally: do not paste our source code, credentials, customer data, or any data obtained during testing into third-party AI services. Doing so is a violation of the scope terms of this policy regardless of the validity of the finding.

Activities that are out of scope

The following are not authorized under this policy:

• Testing against live customer deployments. Do not access, test, or interact with cameras, devices, accounts, or systems belonging to any Flock customer or agency. If you believe you have found a vulnerability that can only be demonstrated against a live deployment, stop and contact us; we will work with you on a safe way to validate it.
• Accessing, downloading, modifying, or retaining law enforcement or investigative data, personal data, or any other customer data. If you encounter such data during testing, stop immediately, do not save a copy, and tell us in your report. Telling us promptly is exactly what we want you to do, and doing so is protected under Safe Harbor; you will not lose good-faith standing for an accidental encounter you report honestly.
• Physical attacks against Flock facilities, personnel, or field-deployed devices.
• Denial of service testing, load testing, high-volume automated scanning, or any other activity that degrades, disrupts, or interrupts service.
• Social engineering, phishing, or pretexting directed at Flock employees, customers, contractors, partners, or vendors. This includes any vulnerability whose exploitation depends on a social engineering component.

Reports we generally consider out of scope

We want reports that describe a plausible attack scenario and a demonstrated security impact. When you write to us, tell us how the issue could be exploited and what an attacker would gain. The following are generally not actionable on their own, and we will usually close them without a fix:

Low or unproven impact

Including but not limited to:

• Findings with no demonstrated security impact, or automated scanner output with no supporting analysis
• Known-vulnerable third-party libraries reported without a working proof of concept
• Software version disclosure, banner identification, and descriptive error messages or headers, including stack traces and server errors
• Content spoofing or text injection where you cannot modify HTML or CSS or otherwise show an attack vector
• CSV injection without a demonstrated vulnerability
• Open redirects, unless you can show an additional security impact
• Clickjacking and tabnabbing on pages with no sensitive actions
• Cross-site request forgery on unauthenticated forms, or forms with no sensitive action

Configuration and hardening preferences

Including but not limited to:

• Missing or suboptimal SSL, TLS, or HSTS configuration, including missing CAA records. Note that certificate validation flaws are in scope and we do want those.
• Missing or incomplete Content Security Policy
• Missing HttpOnly or Secure flags on cookies
• Missing or misconfigured email authentication records, including SPF, DKIM, and DMARC
• Rate limiting or brute force on endpoints that are not authentication endpoints

DNS and infrastructure

Including but not limited to:

• DNS misconfigurations, including dangling DNS entries and claimed subdomain takeovers, without proof of an actual takeover
• Takeover of generic domain verification records

Environment-dependent

Including but not limited to:

• Issues that only affect users on outdated or unpatched browsers, meaning more than two stable versions behind the current stable release
• Publicly disclosed vulnerabilities in third-party components patched within the last 30 days, which we may already be tracking

If you believe an issue on this list is genuinely exploitable in Flock's specific context, send it and explain why. These are defaults, not refusals.

How to report

Email vulnerability.reporting@flocksafety.com.

Flock does not run a paid bug bounty program, and we do not offer monetary rewards for vulnerability reports. We do credit researchers who report valid issues, if they would like to be credited. See Credit below.

If you would like to encrypt your report, use our PGP key: https://www.flocksafety.com/.well-known/security.txt

What to include

The more detail you give us, the faster we can validate and fix the issue. Where possible, please include:

• The affected product, service, or URL, and the version or firmware build if you know it
• A description of the vulnerability and its potential impact
• Steps to reproduce, including any proof-of-concept code, requests, or configuration needed. Console output is fine, videos are better and help us validate and triage the vulnerability faster, and more accurately
• Any relevant logs, screenshots, or output, with customer and personal data removed when possible
• How you would like to be credited, if you would like credit

Please write to us in English if you can.

What to expect from us

‍

If your report falls outside the scope of this policy, or we determine the behavior you found is intended, we will tell you and explain why.

We will not pursue legal action against you for research conducted in good faith and in accordance with this policy. See "Safe Harbor" below for specifics, and a definition of how Flock defines "good faith."

How we assign and publish CVE identifiers

(Starting September 2026)

Flock publishes security advisories for vulnerabilities in our products, and issues CVE identifiers for them.

Assignment. Once we have validated that a report describes a real vulnerability in a Flock product or service, we reserve a CVE identifier for it. A reserved identifier is not public. It exists so that you, we, and any other coordinating party can refer to the same issue by the same name while we work on a fix.

Publication. We publish the CVE record and the corresponding advisory when a patch or mitigation is available, coordinated with you where possible.

If a fix is not available within 120 days of our validating the report, we will publish the record and advisory anyway, describing the issue and any available mitigations, unless doing so would create a material safety risk to law enforcement or the public, in which case we will reach out to you and explain our reasoning. Some of our products are field-deployed hardware with longer release cycles than cloud software, which is why our timeline is longer than the 90 days you may be used to. If a fix is genuinely complex, we may ask you to agree to an extension; we will not extend unilaterally.

We will publish our advisories at https://flocksafety.com/legal/vulnerability-disclosures/advisories. Records are also available through the CVE List at cve.org and downstream databases such as the NVD.

Requirements to participate

• Give us time to fix the issue before you disclose it publicly. We aim to publish when a fix is available; please coordinate your own publication with us.
• Do not access or retain data that is not yours. If you encounter customer, personal, or law enforcement data, stop and tell us.
• Do not degrade our service or our customers' service while testing.
• Only test against systems and accounts that are yours, or that we have explicitly authorized you to test.

Credit

We are glad to credit researchers who report valid vulnerabilities, in the advisory and in the CVE record. Tell us how you would like to be named, or tell us you would prefer to remain anonymous. We will not name you without your agreement.

Safe Harbor

If you conduct security research and vulnerability disclosure in good-faith and in accordance with this policy:

• We will consider your research authorized, and we will not initiate or support legal action against you for it. To the extent permitted by law, this includes claims under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, and analogous state laws.
• We will not report you to law enforcement solely for research so conducted.

What "good faith" means

We do not want this to be a judgment call you have to guess at, so here is what we mean. The following factors inform our assessment of your good faith conduct:

• You followed this policy, including the scope and out-of-scope sections above.
• You made a genuine effort to avoid harm. You did not degrade or interrupt service, and you did not destroy, alter, encrypt, or render unavailable any data or system.
• You stopped at proof. You went no further into a system, and pulled no more data than was necessary to demonstrate that the vulnerability was real. Confirming access is enough; exploring what else that access reaches is not.
• You protected data that was not yours. You did not deliberately access, copy, retain, or transmit data belonging to Flock, our customers, or the agencies they serve. If you encountered such data unavoidably, you stopped, did not keep a copy, and told us.
• You reported promptly, and to us first, before disclosing to anyone else.
• You gave us reasonable time to fix the issue and coordinated any public disclosure with us.
• You kept it to yourself. You did not sell, trade, use, publish, or otherwise share the vulnerability or any data with a third party.
• You did not condition disclosure on payment. Asking whether a reward exists is fine. Withholding details, or threatening to disclose or sell them, unless we pay, is not.
• You cooperated with us, including answering reasonable follow-up questions while we validated and fixed the issue.

‍

Conduct that falls outside good faith, and therefore outside this safe harbor, includes:

• testing against live customer or agency deployments;
• deliberately accessing law enforcement, investigative, or personal data;
• deleting, modifying, or holding data hostage;
• continuing to test after we have asked you to stop;
• extortion or ransom demands;
• disclosing publicly or to third parties without coordinating with us;
• using access gained from one vulnerability to pivot into unrelated systems;
• high-volume automated scanning that degrades service;
• and misrepresenting your identity or using another person's credentials.

‍

We assess good faith on your conduct as a whole, not on a single misstep.

If you accidentally cross a line and tell us promptly and honestly, that counts in your favor. If you are unsure whether a specific action is in scope or authorized, ask us first at vulnerability.reporting@flocksafety.com. We would much rather answer a question in advance than have a good-faith researcher cross a line by accident.

Remember: you are responsible for complying with laws in your own jurisdiction. This policy does not grant permission to access data belonging to third parties, and cannot override applicable privacy or data protection laws.This safe harbor covers Flock's own legal claims only. It does not bind our customers, partner agencies, or third parties, who may have independent legal rights. This is a particular consideration given that some data on our systems belongs to law enforcement agencies and other Flock customers.

Changes to this policy

We may update this policy. The current version is always published at this URL.

‍

‍

‍