COROS EU

Global Vulnerability Disclosure Policy

Introduction

COROS is committed to protecting the security and privacy of its products, software, services, and users. This policy explains how security researchers and other members of the public can report potential security vulnerabilities to COROS and what they can expect after submitting a report.

This policy applies worldwide and covers security or privacy vulnerabilities in COROS-branded devices, firmware, COROS App, Training Hub, websites, APIs, cloud services, and related software. Reporters may use this reporting channel regardless of their country or region; applicable mandatory local laws continue to apply.

Please read this policy in full before conducting security research or submitting a report, and comply with its requirements. The different language versions should remain consistent. Where local law requires a local-language version or additional information, COROS will provide the corresponding version or supplementary information.

COROS appreciates the time and effort that security researchers devote to reporting vulnerabilities responsibly.

Scope

The scope includes official websites and domains owned or controlled by COROS, COROS App, Training Hub, APIs, cloud services, and COROS watches, bike computers, sensors, connected accessories, firmware, and related software that are still within their security support period.

Third-party products, websites, or services, and assets that are not authorized or controlled by COROS, are outside the scope of this policy. COROS makes no guarantees regarding the security, accuracy, or reliability of third-party products, websites, or services.

If you are unsure whether a product, service, domain, or testing activity is within scope, please contact us at product-security@coros.com before testing.

Reporting a Vulnerability

If you believe that a COROS device, application, website, API, cloud service, or related product has a security or privacy vulnerability, please submit a report to product-security@coros.com.

Please include the following information in your report:

  • The affected product, model, software or firmware version, website, API, or service.
  • A clear vulnerability title and technical description.
  • The security impact and the actions an attacker could perform.
  • Detailed, non-destructive steps to reproduce the issue in good faith.
  • A proof of concept, logs, screenshots, or other supporting files, where appropriate.
  • Feasible suggestions for mitigation or remediation, if any.
  • Your name and contact details if you would like us to contact or acknowledge you. Contact details are optional unless you wish to receive status updates.

Security Research Requirements

When conducting security research, please comply with the following requirements:

  • Use only accounts, products, and data that you own or have explicit authorization to test.
  • Limit testing to the minimum actions necessary to confirm the vulnerability.
  • Avoid violating privacy, degrading service quality, or disrupting production systems.
  • If you encounter personal data, confidential information, credentials, or other sensitive information, stop testing immediately and notify COROS.
  • Delete any sensitive information obtained during testing as soon as reasonably practicable, and do not disclose it to any other party.

The following activities are prohibited:

  • Violating any applicable laws or regulations.
  • Accessing, downloading, retaining, or disclosing data beyond what is necessary to demonstrate the issue.
  • Modifying or deleting data in COROS systems or services.
  • Conducting denial-of-service testing, large-scale automated scanning, spamming, social engineering, phishing, or physical attacks.
  • Establishing persistent access, exporting data, pivoting to attack other systems, or interfering with COROS products or services.
  • Publicly disclosing a vulnerability before COROS confirms that remediation is complete or authorizes disclosure in writing.

What to Expect

COROS will acknowledge receipt within 3 business days of receiving a vulnerability report and plans to complete initial triage and technical assessment within 15 business days.

For confirmed security or privacy issues, COROS aims to provide a fix or appropriate mitigation within 90 days of confirmation. If more time is needed because of the scope of impact, remediation risks, third-party dependencies, or other reasonable grounds, we will explain our progress to the reporter.

We will provide a status update at least once every 30 days until the report is resolved or closed. Remediation priorities and timelines will be determined based on impact, severity, exploitability, affected products, and the availability of security fixes.

We may request additional information, invite the reporter to verify a fix, or send a notification after the issue has been remediated. Reports may also be closed as duplicates, informational, out of scope, or not applicable, or because the reported issue cannot be reproduced. Where appropriate, we will explain the reason.

Coordinated Disclosure

Please coordinate any public disclosure with COROS. Once the issue has been remediated, you may request to publish your report. COROS will work with you to agree on appropriate timing and content for disclosure so that affected users receive clear, consistent guidance.

View published security vulnerability advisories →

Related Policies

For the minimum periods of security update support for individual products and software, please refer to the COROS Global Product Security Update Support Policy: Product Security Update Support →

First published: April 10, 2024

Last updated: September 29, 2026