Responsible Disclosure
Found a security issue? Tell us privately.
We welcome good-faith research that helps protect Passary users. Send us the details privately so we can investigate, fix the issue, and coordinate disclosure with you.
01 / Report a finding
Help us reproduce it
A concise report with the right context helps us confirm the issue and act on it quickly. Use SECURITY VULNERABILITY in the email subject line.
What you found
Describe the issue, its potential impact, and the security boundary you believe it crosses.
How to reproduce it
Give clear steps and a minimal test case or redacted screenshots. Do not include real user secrets.
Where you found it
Include the exact app or extension version, build source or revision, feature or URL, and relevant browser, OS, and device.
How to reach you
Provide a reply address and, if you wish, how you would like to be credited.
02 / Research scope
Focus on Passary
Tell us the exact build or source revision you tested. Distribution and signing status vary by platform; check the relevant download page before testing an installer or extension.
In scope
- Passary-operated pages and the web vault on passary.com
- Official desktop and mobile apps, installers, and preview builds, including Windows
- Passary-maintained native app source under active development, with a reproducible build or revision
- Official browser extensions, pairing, and native-bridge components
- Passary-maintained vault cryptography, file formats, import, recovery, and optional sync implementations
- Passary code that could expose vault data or bypass an intended security boundary
Out of scope
- Social engineering, physical intrusion, denial-of-service, high-volume scanning, or spam
- Social media account compromise
- Issues solely in a browser, OS, device, or third-party service and not caused by Passary code
- Testing accounts, vaults, devices, or infrastructure without authorization
This policy does not authorize activity against our hosting provider or another third party. Report a provider-related finding privately and let us coordinate with them.
For intended trust boundaries, see our security overview and encryption details. A documented behavior can still be reportable if you find a bypass or different impact.
03 / Our response
What happens next
We will keep you informed during investigation, remediation, and disclosure. Fix times depend on the issue's severity and complexity.
- 0124–48 hours
Acknowledgment
We confirm receipt and may ask for information needed to reproduce the issue.
- 025 business days
Initial assessment
We assess the severity, scope, and likely impact of the report.
- 03Depends on the issue
Remediation
We develop, test, and deploy a fix, and keep you informed as the work progresses.
- 04After a fix
Coordinated disclosure
We coordinate public timing and details with you. Please allow reasonable time, typically 90 days, before disclosure.
04 / Research guidelines
Research in good faith
These boundaries help you demonstrate a finding without putting people, data, or services at risk.
- Use only your own test vaults, devices, and accounts, or those you are explicitly authorized to test. Stop and contact us if you unexpectedly encounter someone else's data.
- Do not exploit an issue beyond what is necessary to demonstrate it, and avoid privacy violations, data destruction, or service interruption.
- Do not use physical intrusion, denial-of-service testing, or high-volume scanning.
- Keep the finding private while we investigate and allow reasonable time, typically 90 days, before public disclosure.
Your research makes Passary safer
Ready to report?
Send a redacted report to our security inbox. For questions about this policy, use the same address.