Coordinated Vulnerability Disclosure Policy
mBrainTrain D.O.O. Version 1.0 · Effective 18.09.2026 · Next review 18.09.2027
I OUR COMMITMENT
mBrainTrain designs and manufactures electroencephalography (EEG) hardware and the software that accompanies it. Security research on those products is welcome. If you have found a vulnerability in one of our products, we want to hear about it, and this page tells you how to reach us and what happens afterwards.
We will not take legal action against anyone who reports a vulnerability to us in good faith and in accordance with this policy.
II SCOPE
This policy applies to:
- mBrainTrain research-grade EEG devices and their firmware
- mBrainTrain desktop, mobile and library software, including the mbtSDK
- Services operated by mBrainTrain at mbraintrain.com and its subdomains
The following are outside the scope of this policy:
- Systems and networks operated by our customers, including the computers and
networks that our devices are connected to - Third-party services that we use but do not operate
- Reports generated by an automated scanner with no demonstrated impact
- Findings that require physical modification of a device the reporter does not own, or
access to another person’s data
III HOW TO REPORT?
Send your report to support@mbraintrain.com.
Put the word SECURITY at the start of the subject line. This routes the message to the person responsible for security, rather than into the ordinary support queue.
Please include, as far as you are able:
| What | Why it helps |
| The product and the version or firmware revision |
We cannot assess a report without knowing what it applies to |
| A description of the vulnerability and the impact you believe it has |
Impact determines how quickly we act |
| The steps needed to reproduce it | A finding we cannot reproduce cannot be fixed |
| Any proof-of-concept code, logs or captures | Shortens the assessment considerably |
| How you would like to be credited, or that you prefer not to be |
See Recognition below |
Reports may be written in English or Serbian.
IV WHAT WE ASK OF YOU?
- Do not access, modify, delete or store any data that is not your own. Our devices
record physiological data from people, and a report is never worth a subject’s
recording
• Do not degrade, disrupt or interrupt a service or a device in clinical or research use
• Do not use social engineering, physical intrusion or denial of service
• Give us a reasonable opportunity to remediate the issue before disclosing it
publicly. Our default is described under Public disclosure below
• Report on what you find to us only. Please do not sell the findings or pass it to a third
party
V WHAT WE COMMIT TO?
| Stage | Our commitment |
| Acknowledgement | We confirm that we have received your report within 2 business days |
| Assessment | We tell you whether the issue is confirmed, whether it affects a released product, and our initial view of its severity, within 30 days of receipt |
| Progress | While the issue is open, we update you at least every 30 days, even where the update is that nothing has changed |
| Remediation | Confirmed vulnerabilities are remediated in our regular release cycle. A vulnerability we assess as critical is remediated in an out-of-cycle release, targeted within 60 days of the assessment, and sooner where the vulnerability is known to be exploited |
| Notification | Where a vulnerability affects devices already in use, we inform the responsible organisations that operate them |
Where we decide not to remediate a reported issue, we tell you that, and why.
VI PUBLIC DISCLOSURE
We publish information about vulnerabilities that we have fixed in a released product, so that the organisations using our devices can make an informed decision about updating. Our default is coordinated disclosure 90 days after we acknowledge a report, or on the day a fix is released, whichever comes first. We will discuss a different timetable with you where the nature of the issue calls for one — for example where a fix requires a hardware change, or where early disclosure would put patients at risk. We ask that you do not disclose before that date without agreeing it with us first.
VII RECOGNITION
We are glad to credit researchers who report valid vulnerabilities, by name or by handle, in the advisory and on this page. Tell us in your report how you would like to be credited, or that you would prefer to remain anonymous. mBrainTrain does not operate a bug bounty programme and does not offer payment for vulnerability reports.
VIII REGULATORY CONTEXT
mBrainTrain is an EEG device manufacturer. Certain vulnerabilities carry a reporting obligation to regulatory authorities, and we discharge those obligations independently of this policy. A report to us may therefore result in a notification to a regulator. We will tell you if that applies to your report.
IX CONTACT
support@mbraintrain.com — subject line beginning SECURITY
mBrainTrain D.O.O., Bulevar Vojvode Misica 17, Belgrade, Serbia
This policy is published under RFC 9116 at https://mbraintrain.com/.well-known/security.txt.