Responsible Disclosure Policy
How security researchers report vulnerabilities to Smart Citizens.
The essentials
- Report to security@smartcitizens.ae
- Acknowledgement within 2 business days
- Coordinated disclosure — fix first, publish after
- Good-faith safe harbour for legitimate researchers
Proof snapshot
Single reporting channel
security@smartcitizens.ae is the canonical disclosure inbox.
Acknowledgement SLA
Reporters receive a human acknowledgement within two business days.
Coordinated timeline
Fixes deploy first; public write-up follows only with the reporter's agreement.
Evidence checklist
Evidence checklist
- Dedicated security inbox monitored by engineering leadership
- Documented triage flow for suspected vulnerabilities
- Safe-harbour language protecting good-faith researchers
- Public researcher hall-of-fame
- Formal bounty scope and reward tiers
Methodology
Methodology
How it works
Report
Researcher emails security@smartcitizens.ae with a clear description, reproduction steps, and impact assessment.
Acknowledge
Smart Citizens confirms receipt within two business days and assigns an internal owner.
Triage & remediate
Engineering reproduces the issue, scopes affected surfaces, ships a fix, and validates the patch against the reporter's steps.
Coordinate disclosure
Smart Citizens and the reporter agree a public-disclosure timeline once the fix is deployed.
FAQ
FAQ
Frequently asked questions
Where do I report a vulnerability?
security@smartcitizens.ae — include reproduction steps and impact.
How fast will I hear back?
Within two business days for a human acknowledgement.
Is testing allowed?
Good-faith research on public surfaces is welcome. Do not run automated scans that degrade service for live customers.
Frequently asked questions
Frequently asked questions
Where do I report a vulnerability?
security@smartcitizens.ae — include reproduction steps and impact.
How fast will I hear back?
Within two business days for a human acknowledgement.
Is testing allowed?
Good-faith research on public surfaces is welcome. Do not run automated scans that degrade service for live customers.
Smart Citizens. "Responsible Disclosure Policy." Smart Citizens, 2026-07-09. https://ai.smartcitizens.ae/trust-center/responsible-disclosure.
Smart Citizens (2026). Responsible Disclosure Policy. Smart Citizens. Retrieved 2026-07-27, from https://ai.smartcitizens.ae/trust-center/responsible-disclosure
Design your smart environment with Smart Citizens
Talk to Smart Citizens engineers for a bespoke design, budget estimate, and rollout roadmap.