Responsible disclosure

We take the security of KeepSafe seriously. If you believe you have found a vulnerability, we want to hear about it, and we will work with you to understand and fix it.

How to report

Send your report through the contact form, choosing Security as the topic, and include:

• a description of the issue and where you found it;
• the steps needed to reproduce it;
• what an attacker could achieve by exploiting it;
• your name or handle, if you would like to be credited.

Please do not include real credentials or other people’s data in your report.

What we ask of you

• Give us reasonable time to fix the issue before telling anyone else about it.
• Test only against your own account and data. Do not access, change or delete anything that belongs to someone else.
• Do not run tests that could degrade the service for others, such as load or denial-of-service tests.
• Do not use social engineering, phishing or physical attacks against our team or users.

What you can expect from us

• We will acknowledge your report promptly.
• We will keep you updated as we investigate and fix the issue.
• We will not take legal action against research carried out in good faith and in line with this policy.
• With your permission, we will credit you once the issue is resolved.

Out of scope

• Reports from automated scanners without a demonstrated impact.
• Missing best-practice headers or settings with no practical security impact.
• Issues in third-party services that KeepSafe connects to; please report those to the service concerned.