Security

Serin Labs makes hardware and firmware that people put on their home networks, so we want to hear about security problems in it. This page states what we consider in scope, how to reach us privately, what happens after you write, and how a fix reaches the people running the affected firmware. Last updated September 4, 2026.

What is in scope

We will look at a report about any of the following:

This website, serin-labs.com, and the contact API behind the contact form.
The browser flash tools at /flash.html and /flash-link.html.
The firmware builds Serin Labs publishes for the controller and for the Serin Link, together with the manifests that describe them.
The firmware mirror at /firmware/, which serves those same binaries from our own server.
The Serin Link update channel and the image signing it depends on.

How to report privately

Send the report through the contact form. It is the only private channel we operate. The form delivers the message to our mailbox by email, and nothing you send through it is posted anywhere public.

Begin the message with the words “Security report” so we can pick it out, and give us an email address we can reply to. Please do not open a public GitHub issue, post in Discord, or write about the problem publicly before we have had a chance to fix it. Those are the right places for an ordinary bug and the wrong place for this one.

A report we can act on says which part is affected and which version, how to reproduce the problem step by step, and what an attacker gains from it. The message box holds 5,000 characters of plain text and takes no attachments, so describe a proof of concept rather than sending one. If a file is the only way to show the problem, say so and we will arrange it in the reply.

What to expect

We acknowledge a security report within 2 business days, and we reply to the address you give us. Serin Labs is a one-person shop, so we would rather tell you honestly where a fix stands than promise a schedule we cannot keep.

After the acknowledgement we will tell you whether we could reproduce the problem, what we plan to do about it, and roughly when. We are glad to agree a disclosure date with you, and we will let you know once a fix has shipped so you can confirm it. If you would like credit, tell us the name or handle to use and we will name you in the release notes for the fix. If you would rather not be named, we will keep your report to ourselves.

Good-faith research

We will not take legal action against anyone who tests their own equipment and reports what they find in good faith under this policy. We ask you to stay within it. Test only devices and accounts you own or have permission to use, do not access or alter anyone else's data, and stop as soon as you have confirmed a problem instead of digging further into it. Avoid anything that degrades the site or the firmware mirror for other people, such as flooding, denial of service, or spam through the contact form. Give us a reasonable chance to ship a fix before you publish. If you follow these rules and something still goes wrong, tell us what happened and we will treat it as an honest mistake.

Out of scope

Several services we rely on run their own vulnerability programs and are the only ones who can fix their own products. Report problems in Shopify, Etsy, GitHub, Discord, and Resend to those companies rather than to us. Serin Labs does not pay bug bounties.

Bugs in the upstream open-source projects our firmware is built on belong upstream, where a fix reaches everyone using the project instead of only our users. The licenses and compliance page lists each of those projects and links its source. If you are not sure whether a problem is ours or upstream's, send it to us and we will pass it along.

How fixes reach users

Controller firmware is redistributed two ways. Anyone can reinstall the current build over USB from the browser flash tool, and a controller already running our firmware can pull the new version itself through the update check in its web interface. The flash tool reads its list of builds from a manifest rather than from this site, so a new release becomes available without a site update.

Before it writes a byte to the board, the flash tool checks the SHA-256 of the application image against the hash in that manifest. If they disagree it discards the download and fetches the whole build again from the next host in its list. That check is what makes it safe for us to serve the same files from our own mirror and from a public CDN.

The Serin Link updates over the air. Its firmware images are signed, and a Link installs an update only when the signature on the image verifies against the key already on the device.

The devices run on your network

A controller and a Serin Link talk to your indoor unit and to the smart home platform you chose during setup. They do not report to Serin Labs, and there is no Serin Labs account, cloud service, or remote access channel behind them. We hold no telemetry from your equipment and no remote key that would let us into it, which is also why a fix has to reach a device through an update rather than from us.

Machine-readable policy

We publish /.well-known/security.txt in the format described by RFC 9116. It points at the contact form and back at this page.