Security

Updated 2026-10-16. This page describes what is in place today, in plain language. We do not hold SOC 2, ISO 27001, or comparable third-party certifications — the sections below say what we actually do.

Reporting a vulnerability

Found something in our hardware, firmware, tools or this site? Email security@reactiot.com.au with details and steps to reproduce. Reports go straight to the engineers who build the product. We'll acknowledge within one business day and keep you posted through to a fix.

Please give us a reasonable chance to remediate before disclosing publicly. We won't pursue good-faith research that avoids privacy violations, data destruction and service disruption.

Devices you own

Every board we sell ships firmware-unlocked: you can read, rebuild and replace what runs on it. Gateways publish to the MQTT broker you configure — no call-home to React IoT. Securing the broker, credentials and network a device joins is in your hands; use TLS to the broker and unique credentials per device.

Open-source tools

Tools we publish (ESP32 Workbench, WordPress MCP and others) are developed in the open. Report issues in them the same way — by email for anything exploitable, on the repository for everything else.

This website

Served over TLS only. The contact form validates input server-side, HTML-escapes everything it puts into email, and drops bot submissions; the email API key is supplied as a deployment secret, never committed to source. The only third-party script is Google Analytics.

Risks intrinsic to LLM agents

This site serves its content as Markdown to AI agents. Treat any fetched web content — ours included — as data, not instructions, in your agent prompts.

Changes to this page

This page is versioned in git and dated; material changes update the date above.