Govee Bug Bounty Program

1. Program overview

We welcome security researchers and users to responsibly report potential security issues in Govee products, services, or devices through designated channels. We aim to complete the necessary verification, risk control, remediation, and coordinated disclosure without affecting users, devices, data, and other third-party rights.

Submitting a report does not automatically entitle you to a reward. Govee will independently decide whether to confirm the issue and whether to grant a reward, based on actual impact, reproducibility, affected scope, report quality, duplication status, and applicable rules.

2. Scope

Unless otherwise stated on the official program page, this program applies only to Govee-controlled online assets and the product scope below. Third-party platforms, supplier systems, or assets not under Govee management may only be considered if they can be proven to directly impact Govee products, user data, device control, or marketplace funds.

Focus areas

Devices, apps, and the marketplace are listed only to illustrate the scope and do not create differentiated ratings or reward standards. Device-related research may cover firmware, device-cloud communication, pairing and binding, remote control, accounts and permissions, sensitive data, and firmware update chains. Research is limited to objects you own, have purchased, or have explicit written authorization for.

When a single root cause affects multiple scopes, Govee may determine the primary scope and will not pay twice.

3. Severity & rewards

Severity is determined with reference to the CVSS 3.1 base score, and all scopes share the same rating and reward standards. Informational issues or those with no demonstrated security impact do not constitute a vulnerability level.

The amounts in the table are pre-verification, pre-tax suggested standards for a single valid report and do not constitute an offer or fixed price. Govee may determine the final reward based on actual risk and report quality; informational reports generally do not receive cash rewards and may receive public credit or other non-cash recognition at Govee discretion.

CVSS 3.1 scoring serves as the technical baseline; the final level and amount are determined by real-world impact, exploit conditions, affected scope, reproducibility, and remediation value, and are not automatically paid based on a report title or a single score.

4. Reward evaluation

Govee generally considers the following factors:

• Whether the vulnerability is real, reproducible, and within the program scope.
• The identity, network position, preconditions, and user interaction required by the attacker.
• The devices, accounts, data, orders, funds, or business scope that may be impacted.
• Whether it causes device takeover, security protection failure, sensitive data access, persistent access, or quantifiable business loss.
• Whether the report provides a minimal PoC, clear steps, affected versions, and evidence sufficient to support remediation.
• Whether it is the first valid report, whether it bypasses an existing fix, and whether it provides new real-world impact.

For duplicate reports, only the first valid report enters reward evaluation in principle. Subsequent reports may be partially rewarded at Govee discretion if they add new products, versions, root causes, or real-world impact.

The following are generally not eligible for rewards:

• Scanner results, best-practice suggestions, missing hardening, or pure functional issues without demonstrated security impact.
• Issues that are already public, known, or internally recorded by Govee without new impact.
• Purely third-party issues that do not affect Govee products, users, devices, data, or funds.
• Historical versions that cannot be normally reached and that Govee has explicitly stopped supporting, unless still in use or reachable by current products.
• Social engineering, phishing, physical intrusion, destructive testing, denial of service, bulk enumeration, spam, or extortion.
• Issues that can only be triggered after the attacker has fully compromised the terminal, account, or network environment without adding security impact.

Reward eligibility and payment may be subject to identity verification, applicable laws, taxes, sanctions, and Govee payment policies. Rewards are generally denominated in USD; when paid in other currencies, the exchange rate and amount confirmed by Govee apply.

5. Responsible research boundaries

Researchers should use only the minimum access necessary to achieve the validation goal. During research, avoid accessing, copying, modifying, retaining, or disseminating third-party personal information, credentials, device control data, and business data.

Allowed research activities include:

• Using your own accounts, devices, or targets with explicit written authorization.
• Validating a single account, a single device, or minimal test objects with low-impact methods.
• Actively limiting request frequency and testing time to avoid impacting production services and user devices.
• Stopping tests after validation, deleting unnecessary third-party data, and restoring your own devices and test accounts.
• Promptly stopping and contacting Govee when discovering risks that may affect users, devices, or production environments.

Prohibited research activities include:

• Accessing or controlling third-party accounts, devices, or unauthorized data.
• Stress testing, denial of service, bulk registration, bulk login, SMS bombing, or large-scale enumeration against production systems.
• Physical destruction, malicious firmware flashing, prolonged dry-running, continuous remote switching, bypassing safety interlocks, or other tests that may cause harm.
• Obtaining information through social engineering, phishing, impersonation, bribery, or intrusion into third-party suppliers.
• Establishing persistent access, hidden tasks, or attack infrastructure beyond what validation requires.
• Disclosing real user data, valid credentials, or reusable unpatched attack details before the coordinated disclosure deadline.

For safety-sensitive devices such as ice makers, ice food machines, cold beverage machines, freezers, hot beverage machines, and heating devices, do not test temperature control, heating, cooling, motors, protection logic, or scenarios that may create fire, burn, electrical, or food/water safety risks without explicit written authorization and supervision arrangements. Stop testing immediately and contact Govee if abnormal heating, odor, smoke, electric leakage, water leakage, or protection failure occurs.

6. Report submission & handling

Please submit reports through Govee officially published vulnerability intake channels. The report should include as much of the following as possible:

Govee generally confirms receipt within 3 business days and provides initial review progress within 10 business days. Complex hardware, issues spanning multiple product versions, or those requiring additional security validation may take longer; Govee will update the handling status as feasible.

Govee may ask researchers to provide additional information or assist with reproduction. Researchers are not required to provide personal information unrelated to security impact. When a report involves active exploitation, data leakage, device takeover, or other urgent risks, Govee may prioritize containment, evidence protection, and incident response.

7. Program changes & contact

Govee may adjust this program based on product scope, risk posture, operational arrangements, and applicable law. Reports already received are in principle evaluated under the version in effect at the time of receipt, unless otherwise required by law, security, or regulatory requirements.

For questions about scope, report status, rewards, or disclosure arrangements, please contact us through Govee official vulnerability intake channels. Information obtained from unofficial channels should not be regarded as Govee authorization, payment commitment, or official conclusion.