Reporting a vulnerability

We take security reports seriously and appreciate the work of researchers who help keep Vaultigen safe.

How to report

Email [email protected] with the subject line “Security”. Please include:

• the affected Vaultigen version,
• a description of the issue and its impact,
• steps to reproduce, or a proof of concept,
• your name or handle if you would like to be credited.

Do not open public GitHub issues for security problems. Do not include real credentials or customer data in your report.

Our contact details are also published in security.txt.

What to expect

• We acknowledge your report as soon as possible, usually within a few working days.
• We keep you informed while we investigate and fix the issue.
• We publish fixed releases with a note in the changelog and credit you if you wish.

Scope

In scope: the Vaultigen application in its supported configuration, the customer account at account.vaultigen.com and this website.

Please do not run denial-of-service tests, social engineering, or tests against installations you do not own.

Safe harbor

We will not take legal action against research that is done in good faith, stays within this scope, avoids privacy violations and service disruption, and gives us reasonable time to fix the issue before disclosure.