Security Disclosure
UK Product Security and Telecommunications Infrastructure Act 2022 (PSTI)
Locksure takes the security of its connected products seriously. This page describes how to report security vulnerabilities, and sets out our commitments around security updates in accordance with the UK Product Security and Telecommunications Infrastructure Act 2022 and the Product Security Regulations 2023.
How to report a vulnerability
If you believe you've discovered a security vulnerability affecting Locksure, please report it directly and privately. We ask that researchers give us a reasonable opportunity to investigate and resolve the issue before any public disclosure.
Primary reporting channel
| [email protected] | |
| Post | Security Disclosure, Lockstate Limited, 6 Aston Croft, Biggleswade, SG18 8GR |
| Response SLA | Acknowledgement within 5 working days |
| Resolution target | 90 days where reasonably practicable |
What to include in your report
What you can expect from us
Scope
In scope
- Thumb Turn Starter Pack (LSEU02)
- Key Turn Starter Pack (LSEU01)
- Matter Sensor — hub-less (LSEUM-MATTER)
- Locksure mobile apps (iOS & Android)
- locksure.co.uk and customer-facing APIs
- Over-the-air (OTA) update infrastructure
Out of scope
- Open/Close Magnet Accessory (passive, non-connected)
- Physical attacks on unpowered devices
- Attacks on pre-compromised Matter or HomeKit accounts
- Theoretical issues without a realistic attack path
- Automated scan findings without validation
- Social engineering of staff or customers
Minimum security update period
In accordance with Schedule 1 of the Product Security Regulations 2023, Locksure publishes the minimum length of time during which security updates will be provided for each product sold. This information is also printed on each product's Statement of Compliance and on the packaging insert.
| Product | Model | Status | First sold | Security updates until |
|---|---|---|---|---|
| Thumb Turn Starter Pack | LSEU02 | Active | 4 Sep 2024 | 2 years after last sale |
| Key Turn Starter Pack | LSEU01 | Active | 4 Sep 2024 | 2 years after last sale |
| Matter Sensor (hub-less) | LSEUM-MATTER | Active | Q2 2026 (expected) | 2 years after last sale |
Security updates are delivered automatically over the air (OTA) to supported devices that remain connected to the internet. Where a critical update cannot be delivered automatically, Locksure will contact customers directly using the email address associated with their account.
Our security commitments
No universal default passwords
All Locksure connected products use unique per-device credentials or require the user to set a password on first use. Matter commissioning uses per-device cryptographic attestation rather than shared credentials.
Platform and supply-chain security
Locksure builds on Nordic Semiconductor's CSA-certified Matter Compliant Platform (Certificate CSA25001MCPM0001-24). Our Thread and Bluetooth stacks inherit Nordic's vulnerability monitoring and patching processes. We monitor the Nordic Security Advisory feed and CSA Matter Security Advisory feed continuously.
Secure boot and signed firmware
All Locksure firmware updates are cryptographically signed. Devices will reject any firmware image that does not validate against our signing key.
Responsible disclosure
Where we learn of a vulnerability affecting our products — from an external researcher, our own testing, or a component supplier — we will issue a security advisory on this page alongside the patched firmware release, subject to reasonable delay where public disclosure would put customers at greater risk.
Company & regulatory information
| Registered company | Lockstate Limited (13478822) |
|---|---|
| Trading as | Locksure |
| Registered office | 6 Aston Croft, Biggleswade, SG18 8GR |
| Registered in | England and Wales |
| Website | locksure.co.uk |
| Security contact | [email protected] |
| UK regulator | Office for Product Safety and Standards (OPSS) |
If you're not satisfied with Locksure's response to a security report, you may contact the UK Office for Product Safety and Standards at gov.uk/office-for-product-safety-and-standards.