EWatch security

How long EWatch gets security updates

EWatch (models EW-PCB-01, EW-KIT-01, EW-ASM-01) will receive security updates until at least 31 December 2029.

That covers the EWatchOS firmware I ship on the watch and the EWatch drivers I publish. Updates are free. They are installed over USB, from EWatch Cloud or from the source on GitHub. EWatch does not update itself over the air, so I will email registered owners and post here when an update matters.

It does not cover firmware you write yourself or get from someone else. EWatch is a development board as well as a watch: once you flash your own code, the security of that code is yours.

If I extend the date I will change it here. I will not shorten it.

Reporting a security problem

If you find a security problem in EWatch hardware, EWatchOS, the EWatch drivers or ewatch.cloud, email contact@ewanwills.co.uk.

• You do not need an account and you do not have to tell me who you are.
• Say what you found, which model and firmware version, and how to reproduce it if you can.
• I will acknowledge your report within 5 working days.
• I will send you a status update at least every 30 days until it is fixed or closed.

Please give me a reasonable chance to fix it before you publish, and do not access other people's accounts or data while testing. If you act in good faith on those lines I will not take legal action against you, and I will credit you in the fix notes if you want.

I cannot pay bounties.

Security notes