Vulnerability disclosure policy

How to report

Email security@remempass.org with:

• what you found and where (URL, component, or app version and platform);
• steps to reproduce it, or a proof of concept;
• what an attacker could achieve;
• whether, and how, you would like to be credited.

Please do not include real secrets or other people's data in a report. Our security.txt has the same contact in machine-readable form.

In scope

• remempass.org and sync.remempass.org.
• The Remem desktop app, browser extension and command-line tool.
• The cryptography and protocol: end-to-end encryption, key derivation, SRP sign-in, device pairing and sync.
• The open-source code in the Remem repository.

Out of scope

• Denial-of-service and volume testing, and spam.
• Social engineering of anyone, and physical attacks.
• Reports about Cloudflare's own infrastructure. Please send those to Cloudflare.
• Findings that need a device that is already compromised or unlocked, unless Remem makes the compromise worse.
• Missing best-practice headers or banners with no demonstrable impact.

While you research

• Only test against accounts you created yourself.
• Stop as soon as you reach anyone else's data. Do not keep or share it, and tell us.
• Do not degrade the service for others.
• Give us a reasonable time to fix the problem before you disclose it (below).

What we promise

• We will acknowledge your report within 3 working days.
• We will give you an initial assessment within 10 working days.
• We will keep you updated until the problem is fixed, and credit you if you wish.
• We aim to fix critical issues within 30 days, and to agree on coordinated public disclosure within 90 days of your report, sooner once a fix has shipped.
• If a vulnerability is being actively exploited, we will report it as the EU Cyber Resilience Act requires, and tell affected users.

Safe harbour

If you act in good faith and follow this policy, we will not pursue or support legal action against you for your research, and we will treat it as authorised. We cannot speak for third parties, such as Cloudflare. If you are unsure whether something is allowed, ask first at security@remempass.org.