Product Security

How to report a security issue

Protecting our customers from threats to their security is always an important task for Innovative Eyewear, Inc. (Lucyd). As a maker of smart eyewear, we do our utmost to provide our users with secure, stable products and services, and to protect the privacy and security of their data.

We welcome reports of any problem related to product security or user privacy. We follow an established process to address them and give timely feedback.

Report a vulnerability to Lucyd

We encourage organizations and individuals to report any potential security issue to Lucyd's security team.

To report a security or privacy vulnerability, email info@lucyd.co with the subject line "Security report". Include the product model and firmware or app version, and describe the issue in detail. Lucyd will acknowledge your report within 5 working days.

Lucyd may need more information about the reported vulnerability so that verification can begin quickly and accurately.

Responsible reporting guidelines

1. All parties to a vulnerability disclosure should comply with the laws of their country or region.
2. Vulnerability reports should be based on the latest released firmware and app, and preferably written in English.
3. Report vulnerabilities through the dedicated channel above. Lucyd may receive reports from other channels but does not guarantee that they will be acknowledged.
4. Follow data protection principles at all times. Do not violate the privacy and data security of Lucyd's users, employees, agents, services or systems during the vulnerability discovery process.
5. Keep in contact and cooperate during the disclosure process. Do not disclose information about the vulnerability before the agreed disclosure date.
6. Lucyd does not currently operate a vulnerability bounty program.

How Lucyd deals with vulnerabilities

Awareness and receipt → Verification → Remediation → Notification

Lucyd encourages customers, vendors, independent researchers and security organizations to report potential vulnerabilities to the security team. Lucyd also looks for information about vulnerabilities in its products from the community, vulnerability databases and security websites, so that it learns of them as soon as they are discovered.

Lucyd responds to vulnerability reports as soon as possible, usually within 5 working days.

Lucyd works with the product team to make a preliminary analysis and validation of each report, to determine its validity, severity and impact. We may contact you if we need more information about the reported vulnerability.

Once a vulnerability is confirmed, we develop and implement a remediation plan for all affected customers. Remediation typically takes up to 90 days, and in some cases may take longer. You can follow our progress and the completion of remediation activities with the security team.

Lucyd issues a security advisory when one or more of these conditions is met:

1. The vulnerability is rated CRITICAL by the Lucyd security team, Lucyd has completed its response process, and mitigations are available to help customers remove all security risks.
2. The vulnerability has been actively exploited and is likely to increase the security risk to Lucyd customers, or it is likely to increase public concern about the security of Lucyd products. In that case Lucyd will speed up the release of a security bulletin about the vulnerability, which may or may not include a full firmware patch or an emergency fix.

Minimum security update periods

Lucyd provides security updates for the products below from their release until at least 31 December 2028. Updates are delivered through the Lucyd app.

This list is updated as products are added and may change without notice. A support period is never shortened for a product that has already been sold.

Security advisories

No security advisories have been issued.

---

Manufacturer: Innovative Eyewear, Inc., Miami, Florida, USA. Contact: info@lucyd.co