Security

Embedthis takes the security of its software seriously. Our products are often deployed on devices that remain in service for many years and may be difficult to update. Security is therefore built into our products from the outset and maintained throughout their supported lifecycle.

Reporting a Vulnerability

If you believe you have discovered a security vulnerability in an Embedthis product, please report it to security@embedthis.com.

Please include:

• The affected product and version
• A description of the vulnerability and its potential impact
• Steps or sample code needed to reproduce the issue

We will acknowledge your report promptly and keep you informed as we investigate, develop a resolution, and coordinate disclosure.

Responsible Disclosure

We appreciate responsible security research and ask that you allow sufficient time for the issue to be resolved before making it public.

Our web servers and device agents are embedded in device equipment, not run as standalone software. A fix does not reach a deployed device until each manufacturer takes it, rebuilds and re-qualifies their firmware, and ships an update that operators then install. This takes considerably longer than updating conventional enterprise software. Disclosing before devices can be updated would expose them to attack, so responsible disclosure for embedded software needs a longer embargo. We coordinate public disclosure so that a security update is available and affected manufacturers have had a reasonable opportunity to update their products.

• Coordination window. The default coordination window is 180 days from acknowledgement, by which point we intend to have published a fix and the advisory.
• Fix first, advisory second. The advisory is published once a fix or an effective documented mitigation is available, and once customers have had reasonable time to apply it.
• Exploited vulnerabilities. If a vulnerability is being exploited in the wild, or is independently disclosed by a third party, we end the embargo and publish what customers need to defend themselves.
• Deadlines. If you intend to publish at a fixed deadline, say so in your first email. We will work to it and tell you plainly if we cannot meet it.
• Credit. Advisories credit the reporter unless you ask us not to.

Following this coordination period, we publish vulnerability details, including the affected versions, security impact, and available remediation.

Security Notifications

Customers are notified of security issues and updates through the Embedthis Builder. You can subscribe to security notifications in the Builder to receive advisories and remediation information before public disclosure. Releases and supported versions are also published in the Builder.

Security Engineering

GoAhead, Appweb and Ioto are continuously audited and tested by our security engineering program. Read how we secure our servers.

Security Leadership

Michael O'Brien, as founder of EmbedThis, leads the company's product security program and is responsible for security engineering, vulnerability management, coordinated disclosure, and ongoing security of the GoAhead, Appweb, and Ioto embedded web servers.

EmbedThis maintains a secure software development lifecycle incorporating proactive vulnerability research, code auditing, security testing, vulnerability remediation, and timely security updates to protect the hundreds of millions of devices that depend on its software.

EmbedThis supports the European Union Cyber Resilience Act (CRA) requirements across its product portfolio. See CRA Support.