Security

We build hardware and software that people plug into their devices. If you have found a vulnerability in a Liion Power product, we want to hear from you.

How to report

Email security@liionpower.tech.

Please include:

• Which product and version is affected. For Leo, the firmware version is shown in the app under Settings > Device
• What you found, and how to reproduce it
• What impact you believe it has, and what an attacker would need in order to exploit it
• Any proof-of-concept code, screenshots or packet captures that help us confirm it

Reports in English are easiest for us to act on quickly. Dutch is also fine.

What we will do

When	What
Within 3 business days	We acknowledge your report and give you a reference
Within 10 business days	We tell you our assessment: whether we can reproduce it, how we rate the severity, and what we intend to do
Every 14 days	We keep you updated until the issue is closed
When a fix ships	We publish an advisory and, unless you prefer otherwise, credit you

If we conclude the issue is not a vulnerability, or is out of scope, we will tell you why rather than going quiet.

What we ask of you

• Give us 90 days before disclosing publicly, or less if we ship a fix sooner. If we are struggling to fix something in that time we will tell you and discuss it rather than expecting silence
• Only test against devices and accounts you own
• Do not access, modify or delete data belonging to other people
• Do not degrade our services for other users. No denial-of-service or volumetric testing
• Do not use social engineering, phishing or physical intrusion against our staff or premises

Safe harbor

If you act in good faith and within this policy, we will not pursue or support legal action against you in relation to your research, and we will treat your work as authorized.

If you are unsure whether something is in scope, ask us first at security@liionpower.tech and we will tell you.

We cannot waive the rights of third parties, and this policy is not a guarantee against action by anyone other than us.

What this policy covers

In scope:

• Leo hardware and firmware
• The Leo companion apps for iOS and Android
• Our backend services and APIs used by Leo and the app
• liionpower.tech and its subdomains

Out of scope:

• Denial-of-service or load testing
• Findings from automated scanners with no demonstrated impact
• Missing security headers or best-practice recommendations with no demonstrated impact
• Third-party services we do not operate
• Issues requiring a phone the attacker already fully controls
• Social engineering of our staff or customers

If something falls outside this list but you think it matters, send it anyway. The list is guidance, not a gate.

We do not pay bounties

We do not currently run a paid bug bounty program. We are a small company and would rather be honest about that than imply otherwise. We do credit reporters in our advisories, and we are grateful for the work.

Security advisories

We publish advisories for fixed vulnerabilities on our Security advisories page, including the affected versions, the impact, and what users should do.

Support period

Leo receives security updates until December 2031. Details of the support period are in the product information in the app under Settings > About.

Reporting to EU authorities

Where required by Regulation (EU) 2024/2847, the Cyber Resilience Act, we report actively exploited vulnerabilities and severe security incidents to the relevant EU authorities. This is separate from, and does not replace, informing you and our users.

Last updated October 28, 2026.