HEAR DAD LLP Logo
HEAR DAD LLP Vulnerability Disclosure Policy
Back to Home
SECURITY & INFRASTRUCTURE PROTECTION

Vulnerability Disclosure Policy

Heardad LLP | Security & Infrastructure Protection

Document Version: 1.0 • Effective Date: August 20, 2026 • Safe Harbor: Good-Faith Research Protected

At Heardad LLP, the security of our autonomous drone infrastructure, digital airspace management systems, and corporate data is our highest priority. We recognize the vital role that independent security researchers and the cybersecurity community play in keeping our platforms secure. This Vulnerability Disclosure Policy outlines our expectations, scope, and procedures for reporting security vulnerabilities.

1 Scope of Disclosure

This policy applies specifically to the digital assets and software infrastructure managed by Heardad LLP. The following assets are considered In-Scope for security research:

Corporate Web Presence: heardad.com and associated subdomains.
Flyzo Product Platform: flyzo.heardad.com, including ground station dashboards and authentication portals.
LATIC & Telemetry APIs: APIs used for multirotor flight path generation, agricultural spraying task coordination, and digital twin modeling endpoints.
Ground Control Systems: Publicly accessible endpoints interfacing with our VTOL or drone command-and-control (C2) infrastructure.

2 Out of Scope

To ensure the safety of our physical hardware and the continuity of our airspace management services, the following activities and assets are strictly Out of Scope:

  • Physical security testing of our facilities, drones, hardware components (motors, ESCs), or testing environments.
  • Social engineering (e.g., phishing, vishing) directed at our employees, contractors, or clients.
  • Volumetric attacks, including Distributed Denial of Service (DDoS) or any activity designed to disrupt service availability.
  • Attacks targeting third-party services, cloud hosting providers, or external integrated platforms (e.g., third-party weather APIs or QGroundControl dependencies).

3 Rules of Engagement

When conducting vulnerability research, we require that you adhere to the following guidelines:

No Data Exfiltration: Do not download, exfiltrate, or alter any corporate or user data. If you encounter sensitive information, stop your research and report the vulnerability immediately.
No Service Disruption: Conduct your testing in a manner that avoids degrading the performance of our web applications, flight simulators, or operational workflows.
Test Environments: Whenever possible, create a dedicated test account using your own resources. Do not interact with other users' accounts or data without explicit permission.
Confidentiality: Do not publicly disclose the vulnerability until Heardad LLP has confirmed that it has been remediated.

Safe Harbor Agreement

Heardad LLP considers good-faith security research conducted in accordance with this policy to be authorized. We will not initiate legal action or law enforcement complaints against researchers who strictly adhere to these guidelines. If legal action is initiated by a third party against you for activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with our Vulnerability Disclosure Policy.

4 Reporting a Vulnerability

If you believe you have discovered a security vulnerability within the defined scope, please submit a detailed report to our security team. We ask that your report include:

  • A clear description of the vulnerability, including its potential impact.
  • Step-by-step instructions or Proof of Concept (PoC) code to reproduce the issue.
  • The specific URLs, IP addresses, or API endpoints affected.
  • Details of the environment and tools used during your research.

Contact Email: security@heardad.com

Note: If you are transmitting sensitive PoC data, please request our public PGP key via email prior to sending your report.

5 Our Commitment

Upon receiving your vulnerability report, Heardad LLP commits to:

Timely Response: Acknowledging receipt of your report within 3 business days.
Remediation Timeline: Providing an estimated timeline for triage and remediation.
Open Communication: Maintaining open communication with you throughout the patching process.
Recognition: Recognizing your contribution (with your permission) once the vulnerability has been securely resolved.