This page is where vulnerabilities in Segway-Ninebot products with digital elements can be reported, and where we publish vulnerability information. We work with external security researchers to improve the overall security of our products, and provide security advisories and support-period information to keep users informed and safe.

Segway-Ninebot products with digital elements include: electric kickscooters, self-balancing vehicles, eBikes, Navimow robotic mowers, and their software and mobile applications.

Version 1.0 · Effective 2026-09-01 · Maintained by the Segway-Ninebot PSIRT

Scope.All Segway-Ninebot products with digital elements placed on the market, including embedded software, mobile applications and remote data processing solutions related to these products.

How to report.Email is@ninebot.comwith the product name and software version, a description of the vulnerability and steps to reproduce it, and — if known — whether it is public or actively exploited. Anonymous reports are accepted. Where sensitive details are involved (exploit code, customer data, keys, configuration data), we recommend encrypting them with ourPGP public key; where convenient, please include your own PGP key so that we can share sensitive information with you securely.

What to expect.We will stay in contact with you throughout the process: we acknowledge your report within 3 business days, provide an initial assessment within 10 business days, and keep you informed with status updates at least every 30 days until the issue is resolved. Vulnerabilities are remediated without undue delay; security updates are provided free of charge.

Coordinated disclosure.We ask reporters to keep details confidential until a security update or mitigation is available. The default coordinated disclosure period is 90 days from triage confirmation, unless a different period is agreed with you for reasons such as remediation complexity or supply-chain coordination; once remediated, we publish a security advisory and, with your consent, credit you in it.

Good-faith research. Research conducted in good faith under this policy is authorized: do not access others' data, do not degrade the availability or safety of products in use, comply with applicable law. Segway-Ninebot will not initiate legal action for research conducted in accordance with this policy.

Published after a security update or corrective measure is available. Each advisory describes the vulnerability and its severity, affected versions, and how to obtain and install the fix.

Security updates are delivered over-the-air via the Segway-Ninebot / Navimow app and installed automatically by default (opt-out available in app settings). Each released update remains available for at least 10 years or the remainder of the support period, whichever is longer.

Security updates are delivered over-the-air via the Segway-Ninebot / Navimow app and installed automatically by default (opt-out available in app settings). Each released update remains available for at least 10 years or the remainder of the support period, whichever is longer.

Segway Ninebot·Manufacturer under Regulation (EU) 2024/2847 Example Street 1, 1000 AA Amsterdam, Netherlands · is@ninebot.com.

EU declarations of conformity