Babaru is silly. Our security work isn't.
Found something that does not look right? Tell us. This page explains how to report a security issue, what happens next, and how long we support Babaru with security updates.
Last updated: 27 July 2026
Security updates supported until at least 30 June 2028 For every edition of the Babaru Smart Plush.Spotted a security issue?
Please report possible vulnerabilities in Babaru hardware, firmware, the companion app, or our related services to security@babaru.ai.
After that first update, we will keep you informed at appropriate intervals until the issue is resolved or closed. For a sensitive or encrypted report, email us first and we will arrange a secure channel.
What helps us investigate
- The product, firmware, or app version involved
- A clear description of what you found
- Steps we can use to reproduce it
- Proof-of-concept code or screenshots, if relevant
- A safe way to contact you with updates
Play fair while testing
- Only test devices, accounts, and data you own or have permission to use
- Do not disrupt Babaru services or access another person's data
- Give us a reasonable chance to fix the issue before sharing it publicly
- We normally ask for up to 90 days for coordinated disclosure
Security update support
No fog machine, no tiny print. Here is the minimum support period and how updates reach your Babaru.
- Product
- Babaru Smart Plush, all editions
- Minimum support end date
- 30 June 2028
- What is covered
- Security fixes for Babaru firmware, Bluetooth components, the companion app, and security-critical supporting services
- How updates arrive
- The Babaru companion app downloads signed updates and transfers device firmware to Babaru over Bluetooth
- Update settings
- Updates are opt-in by default. Critical security updates may be delivered automatically where needed to protect the product and its users
This is a minimum commitment, not an expiry timer. We may extend support and will update this page if the date changes. Feature releases, new games, and personality changes are separate from this security commitment.
Security advisories
Nothing to list yet. If that changes, advisories and their resolution status will appear here.
The plain-English PSTI checklist
Babaru follows the UK consumer connectable product security regime established by the Product Security and Telecommunications Infrastructure Act 2022 and the 2023 security regulations, which took effect on 29 April 2024.
No universal default passwords. Babaru uses authenticated Bluetooth Secure Connections pairing instead.
A public way to report vulnerabilities. That is the security contact and response process above.
A clear minimum update period. Security updates are supported until at least 30 June 2028.
For the official framework, see the UK government's consumer connectable product security guidance.