Tell us before you tell anyone else.

When you will hear back

We acknowledge a report within 3 days, send an assessment within 10 days, and aim to ship a fix or a mitigation within 90 days. If a fix needs longer, we say so and agree a disclosure date with you. You may publish after the fix ships, or after 90 days if we have not.

Good-faith research

We will not sue or refer for prosecution a person who reports a vulnerability in Vowkey in good faith and gives us a chance to fix it. Good faith means you act to protect the people who use Vowkey.

• Test against your own account, your own vault, and local builds.
• Do not read, change, or delete someone else's vault, and do not keep their data if a test exposes it.
• Do not interrupt the service with volume. A proof is a single request, not a flood.
• Ask before a test that would touch accounts other than your own.

There is no bounty yet

We do not pay for reports today, and we do not list Vowkey on a bounty platform. That will change when report volume justifies a program. A report is still welcome, and we will credit you when you want to be named.

What to send

The inbox reads English, Vietnamese, and Japanese. The other launch languages are welcome. Include the affected app or server version, what an attacker can do, and the smallest steps that show it. Encrypt the mail if you prefer: the security page links the key when one is published.