Report a security problem
Email security@hushvault.in. A human reads every report.
What to send
- What you found and where (a URL, a file or a part of the design).
- Steps to reproduce it, and what an attacker could do with it.
- How you'd like to be credited, if at all.
Plain text is fine. Please don't put real passwords or other people's data in the report.
What to expect
- A reply within 7 days, saying whether we could reproduce it.
- Updates until it's fixed, and credit when the fix is out, if you want it.
- Please give us 90 days before going public, or less once a fix ships. We'll agree a date with you.
Scope
In scope: this website, and the design described in How Hush works (key derivation, encryption, what the server can learn). A flaw in the design is the most valuable kind of report.
Out of scope: denial of service and load testing, social engineering, physical attacks, reports from automated scanners without a demonstrated problem, and missing headers on this static site that don't lead to an attack.
The Hush service isn't open to the public yet, so there are no public servers to test.
Good-faith research
If you follow this policy, stay in scope, avoid harming people's data or our service, and give us time to fix what you find, we won't take legal action against you and we'll treat your research as authorised.