At Head Watersports, the safety and security of our divers are our highest priorities. We recognize the critical role our dive computers play in underwater safety. We welcome the contribution of security researchers and our community to help us maintain the highest standards of cyber resilience.
This policy applies to:
• All Mares dive computer hardware.
• Device firmware and official software updates.
• The Mares mobile application (iOS/Android).
• Our cloud synchronization and log-book services.
If you believe you have found a security vulnerability or a potential safety-critical flaw in our products, please notify us immediately.
REPORT VULNERABILITIES
• Address: Head Watersports, Salita Bonsen 4, 16035 Rapallo, Italy
What to Include:
• The product model and firmware version.
• A brief description of the vulnerability.
• Step-by-step instructions to reproduce the issue (PoC).
In accordance with our obligations under the EU Cyber Resilience Act, we commit to the following:
• Acknowledgment: We will acknowledge receipt of your report within 7 business days.
• Status Updates: We will provide regular updates as we investigate and remediate the issue.
• Transparency: Once a fix is developed and deployed, we will issue a Security Advisory to inform our users, giving you credit for the discovery (if desired).
We will not take legal action against researchers who:
• Avoid causing harm to users or equipment.
• Do not access, modify, or delete user data.
• Provide us a reasonable amount of time to fix the issue before making any information public (Responsible Disclosure).
• Do not perform ”Denial of Service” (DoS) attacks that could impact the safety functions of the device.
• Under the CRA, Head Watersports guarantees security updates for a minimum period of 5 years from when the product is first offered for sale.
• Software & firmware updates for dive computer hardware products are available at www.mares.com or through the Mares app
Updates for the Mares mobile application are available through the Apple App Store or Google Play Store
Note to Researchers: As a manufacturer under EU jurisdiction, Head Watersports is legally required to notify ENISA and CSIRT Italia of any ”actively exploited” vulnerabilities within 24 hours of confirmation. Your detailed reports help us meet these critical safety deadlines.