Reporting a security problem with an AWOW product

Email: security@arcadewow.app (our older address security@hillcraft.dev still works)

Security updates: AWOW provides security updates for the AWOW Home Jukebox for at least 1 year from the date of purchase; for units sold now, that is until at least 30 September 2027. Updates are delivered on a replacement SD card, free of charge. We may extend this period, and we will never shorten it.

• AWOW jukebox cabinets and AWOW home jukebox units, including the AWOW software on the SD card and any AWOW add-on installed on your own Raspberry Pi.
• The AWOW companion apps for iPhone, iPad and Mac.
• AWOW's online services, including arcadewow.app, go.arcadewow.app, api.arcadewow.app, ota.arcadewow.app, sing.arcadewow.app, awow.hillcraft.dev and awow-ota.hillcraft.dev.

It does not cover speakers, TVs or services made by other companies (for example Sonos, Bose, Denon/HEOS, Yamaha, WiiM, Apple, Google or Spotify). Please report those to the company that makes them. If you are not sure whose problem it is, tell us anyway and we will pass it on with your permission.

• Email security@arcadewow.app, or use the form below. It goes to the same place.
• We will never ask you for a password, payment details or remote access to your devices.

• Which product and version: the jukebox shows it in Settings › About, and so does the app.
• What you found, and what someone could do with it.
• The steps to reproduce it, or a short proof of concept.
• How to contact you if you want a reply. This is optional: anonymous reports are welcome.

We acknowledge security reports within 7 days, and if you left an address we update you at least every 30 days.

• Acknowledgement within 7 days of receiving your report. If you gave a contact address, we reply there.
• Updates at least every 30 days until the issue is resolved.
• Fix: we aim to fix serious problems within 90 days, and to agree with you when the details can be made public. If a fix will take longer, we will tell you why.
• Credit: with your permission, we will thank you by name on this page once the issue is fixed.

If you act in good faith and follow this policy, AWOW will not take legal action against you, or ask anyone else to, for your research. That means: only test products and accounts you own, or have the owner's permission to test; do not access, change or delete other people's data; do not disrupt our services or other people's devices; and give us reasonable time to fix a problem before you publish it. This promise cannot give you permission to test systems that belong to other people or companies.

For at least 1 year from the date you buy it (for units sold now, until 30 September 2027), if we learn about a security weakness in your AWOW jukebox, we will fix it and send you the fix at no charge. After that your jukebox keeps working, but we no longer promise to fix new security problems.