Report a vulnerability

How to report

Send your report with the form below. It goes straight to the people who fix security issues, and we reply to the email you give.

Write in English, and keep the details between us until the issue is fixed.

What we promise

We don't pay rewards for reports at the moment. We are grateful for every valid report and thank researchers publicly.

• A reply within 3 working days to confirm we received your report.
• Updates at least every 2 weeks while we look into it and fix it.
• A fix within 90 days of your report, and much sooner for anything that puts users' data at risk.
• A word when it's fixed, so you can check the fix and, if you like, publish your findings.
• Credit, with your permission, on this page.

Safe harbor

If you act in good faith and follow this policy, we will not take legal action against you or ask anyone else to, and we will treat your research as authorised. If someone else takes legal action against you for research that followed this policy, we will make it known that you acted with our permission.

If you are not sure whether something you want to try is allowed, ask us first with the report form.

Rules for testing

• Test only with accounts you own or have permission to use. Create test accounts for anything that involves sharing.
• Never access, change or delete other people's data. If you reach someone else's data by accident, stop, don't keep a copy, and tell us.
• Don't degrade the service for others: no denial-of-service, no flooding, and keep automated scanning slow.
• Don't use phishing, social engineering or physical attacks against SyFly, its staff or its users.
• Keep the details private until we have fixed the issue, or until 90 days have passed since your report.

In scope

Issues we especially want to hear about: anything that lets someone read, change or delete another person's vault data, take over an account, get around two-factor sign-in, Face Key or a security key, or weaken the encryption.

• The SyFly web app and API at syfly.io
• Sign-in with SyFly at oauth.syfly.io
• The SyFly browser extensions (Chrome, Edge, Firefox, Opera, Safari)
• The SyFly desktop apps (macOS, Windows) and mobile apps (iPhone, Android)
• The encryption and sharing design described on the Encryption and Face Key pages

Out of scope

• Denial-of-service and volume attacks
• Reports from automated scanners without a working proof of impact
• Missing security headers or settings with no shown way to exploit them
• Attacks that need a device that is already compromised, unlocked and in the attacker's hands, or a jailbroken or rooted phone
• Self-XSS, clickjacking on pages with nothing sensitive to click, and logout or login CSRF
• Email settings such as SPF, DKIM and DMARC, unless you show a real way to spoof SyFly
• Issues in third-party services we use, which should go to their owners

Thanks

Researchers who report a valid issue are thanked here by name, with their permission.