Security & Vulnerability Reporting

Our position

We welcome vulnerability reports from good-faith security researchers. To help keep HearRelay and its related services safe, please practice responsible disclosure. This policy sets out the scope we ask you to observe and how we will respond.

How to report

If you find a vulnerability, please email the dedicated address at the bottom of this page. Site-wide contact details are also published at /.well-known/security.txt (RFC 9116). Where possible, please include:

• The affected feature, version, and OS
• Steps to reproduce (attach a PoC if you have one)
• The expected impact
• How to reach you

In scope

• The HearRelay iOS / iPadOS application itself
• Pages on conex-cp.com relating to HearRelay

Out of scope

The following are out of scope for this policy:

• Social engineering, physical intrusion, and attacks against our staff or partners
• Denial of service (DoS / DDoS), spam, and volumetric attacks
• Vulnerabilities in Apple’s infrastructure (the App Store, iCloud, iOS itself) or third-party services
• Issues that require physical access to a user’s own device and present no realistic threat

Safe harbor

For research conducted in good faith and within the scope of this policy, we welcome your work and will not pursue legal action on the basis of that research. When researching, please avoid violating privacy, destroying or altering data, or disrupting the service, and do not access third-party data. Please do not disclose a vulnerability to others until we have had a reasonable opportunity to address it (coordinated disclosure).

How we respond

• We will acknowledge receipt within a reasonable period.
• We will validate the report and prioritize a fix according to its impact.
• We will share the status of the fix with the reporter where we can.
• We do not currently run a monetary reward (bug bounty) program, but we are grateful for your help.

A note on design

HearRelay is designed so that audio is never sent to a server, pair communication is end-to-end encrypted, and connections are limited to the same local network (see the Privacy Policy and the product page for the design intent). Observations about the design are also welcome.