Security

Report it privately. Get credited publicly.

Found a vulnerability? It reaches us fastest by email — plain text or PGP-encrypted, whatever the details need. We aim to read every report, we aim to fix before we publish, and when the fix ships, your name goes on this page if you want it there.

Email [email protected]Encrypt it — PGP key security.txt

Please don't send security reports through the general contact or ideas forms — this address reaches the right person directly.

What to send

The short version is fine. The repro is better.

What you were testing — the app version, the platform and OS.
What you did, what you saw, and what you expected instead.
The smallest set of steps that reproduces it.
A proof-of-concept or screenshots, if you have them.
A way to reach you, if you want credit or updates. Anonymous is fine too.

You do not need a polished writeup to write in. A half-formed report that lets us reproduce the problem is worth more than a perfect one that arrives never.

How it works

Report it. We fix it. You get named.

Reach us directly

Email [email protected] — plain text is fine, or encrypted with our PGP key if the details are sensitive. Say what you found, how to reproduce it, and what you think an attacker could do with it.

We confirm, then we fix

If you included a way to reply, you get an acknowledgment — and updates as we work, not silence. We ask for reasonable time to investigate and ship a fix before any public disclosure, and we will name the date once we know it.

Stay inside the vault — yours, not other people's

Test against your own device and data. Do not access, modify, or exfiltrate another user's vault, even to prove a point — that crosses from research into the exact harm this design is meant to prevent.

You get credited, not ignored

Every confirmed, responsibly disclosed vulnerability earns an entry below once the fix has shipped — your name or handle, what class of issue it was, and the date it was resolved. Or stay anonymous; the report speaks for itself.

Safe harbor

Good-faith research is welcome.

If you test against your own devices and your own vault, never touch another person's data, and give us a reasonable window to fix before going public, we do not intend to pursue legal action over your research. We consider good-faith security research authorized here; it is how the vault gets stronger. This is a statement of intent, not a legal contract.

If a test ever looks to us like it went past that line, we will contact you first.

The list

Confirmed reports.

Nobody's here yet.

Prevon is in private beta, and no vulnerability report has been confirmed and fixed yet. The moment one is, this space becomes the first entry.