Product Security Policy
This policy describes how Chengdu Hotack Technology Co., Ltd. secures LuminaOS projectors and Lumina services, how long we provide security updates, and how to report a vulnerability. It supports our obligations under the EU Radio Equipment Directive (Delegated Regulation (EU) 2022/30, harmonised standards EN 18031-1/-2/-3) and the reporting obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847, Article 14).
1. Report a vulnerability
| security@luminago.app (PGP key: [fingerprint / URL]) | |
| security.txt | https://legal.luminago.app/.well-known/security.txt |
| What to include | Affected product and firmware or app version, description and impact, steps to reproduce, and whether the issue is being exploited |
| Our commitment | Acknowledge within 3 business days; first assessment within 10 business days; status updates at least every 30 days; credit in the advisory if you wish |
| Safe harbour | We will not take legal action against good-faith research that respects users' privacy, avoids service disruption, and gives us reasonable time (normally 90 days) to fix the issue before disclosure |
2. How we handle vulnerabilities
- Triage using CVSS v3.1 or v4.0 and a check for active exploitation.
- Fix targets from confirmation: critical within 30 days, high within 60 days, medium and low in the next scheduled update.
- Distribution through the automatic software update (OTA). Updates are cryptographically signed and verified by the projector before installation.
- Advisory on our security page listing affected versions, fixed versions and workarounds.
- Authority notification: since 11 September 2026 we notify actively exploited vulnerabilities and severe incidents affecting product security through ENISA's Single Reporting Platform. We send an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days after a fix is available (one month for incidents). We inform affected users and tell them what to do.
3. Security support period
We provide security updates for each projector model for at least [5] years after it was last placed on the market, until at least [date]. The end date for each model is published on this page and shown in Settings › About. We tell users in advance on the projector when the support period is about to end.
4. Device security baseline
Each firmware released for sale in the EU meets the following requirements. Items marked with a fix tag are being introduced. FIX-15
| Area | Requirement |
|---|---|
| Build | Production ("user") build; debugging interfaces (ADB over network and USB) disabled by default and protected when enabled |
| Signing | Firmware, system apps and updates signed with private Hotack release keys held in a protected key store. Public test keys are never used. |
| Boot integrity | Verified boot with rollback protection; the bootloader is locked |
| Isolation | SELinux in enforcing mode; Android app sandbox; system components expose no unprotected interfaces to other apps |
| Patch level | Android security patch level no older than [6] months at release; monthly review of Android and chipset security bulletins |
| Network | Only encrypted connections (TLS 1.2 or later) to Hotack services; cleartext traffic disabled for Hotack apps; requests signed with a per-device key generated on the projector and stored in the Android Keystore; no shared API keys in apps; no default or shared passwords |
| Local network services | Remote control, file upload, screen mirroring and Bluetooth services accept connections only after pairing or confirmation on the projector, and use per-device credentials FIX-06 FIX-17 |
| Credentials and keys | No API keys, passwords or encryption keys of Hotack services embedded in apps in a form that gives access to other users' data |
| Software provenance | Every pre-installed app is listed in the software inventory, with its publisher and purpose. LuminaOS contains no proxy, "bandwidth sharing" or remote-access software. We keep a software bill of materials (SBOM) for each firmware. |
| Remote actions | Our servers cannot reboot the projector, install or remove apps without your settings allowing it, or run commands on it. App updates follow the App Store settings (Privacy Policy 4.3). The voice-assistant cloud link accepts commands only for a projector whose owner turned the link on, and only from that owner's linked assistant account. FIX-01 FIX-02 |
| Data protection | Personal data on the device stored in app-private storage; diagnostic reports readable only by system apps; factory reset erases all user data |
5. Cloud service security
- All service endpoints use HTTPS with current TLS configuration and HSTS; certificates are monitored for expiry. FIX-16
- Device-facing and administrative interfaces use separate credentials; administrative access requires individual accounts and multi-factor authentication. FIX-06 FIX-08
- Every request that controls a device or reads device data is authenticated and authorised for that device. No public test or debug endpoints are deployed. FIX-06
- Stored diagnostic reports are private and are accessed through short-lived signed links. FIX-04
- Logs exclude command content, voice content and secrets; IP addresses are shortened; logs are kept only for the periods in Data Retention.
- Storage buckets are private; files are served only through short-lived signed links. No administrative or status endpoint is reachable without authentication. FIX-04
- Access to personal data is limited to staff who need it and is logged.
6. Third-party components
We track the open-source and third-party components in LuminaOS and the Lumina apps. We apply their security fixes in our regular updates and replace components that are no longer maintained. Third-party apps pre-installed on the projector are updated by their publishers or through the App Store or Google Play.
7. What you can do
- Keep automatic updates on and connect the projector to the internet regularly.
- Use a secured (WPA2/WPA3) Wi-Fi network.
- Install apps only from trusted sources.
- Before selling or giving away the projector, perform a factory reset and unlink it from Lumina Go, Alexa or Google Home.