Security policy
This page is the policy that /.well-known/security.txt points to.
Reporting a vulnerability
Email security@ironkeel.app with a short description. Leave out exploit details and any user data in the first message; we reply with an encrypted message you can send the full details through. Never put details in a public issue.
Include:
- the affected part: the account service and website, the VPN servers, or a client;
- the version you tested, if you know it;
- steps to reproduce, with a proof of concept where one is safe to share;
- the impact as you understand it: what an attacker learns or can do.
Never send user data of any kind, live account numbers (use a test account, or keep only the last four digits), or other people's captured traffic.
Test only against your own accounts and your own devices. Never test against other users' traffic, never try to identify anyone, and stop as soon as you can show the issue. Do not degrade the service for others.
Scope
In scope: the account service and this website, the VPN servers and their configuration, and the software that runs them, within the testing rules above.
Also in scope: the Android app and the key ironkeel signs it with, including any app signed with that key that ironkeel did not release. Android itself, GrapheneOS and the official WireGuard apps are upstream projects.
Out of scope: volumetric denial of service; social engineering of ironkeel, its hosting providers or its users; issues in hosting providers or upstream projects (report them upstream, and tell us if our configuration makes them worse); and automated scanner output without a demonstrated impact.
Our commitments
| What | When |
|---|---|
| Acknowledge the report | within 3 business days |
| Triage with a severity | within 7 days |
| Fix or mitigation, high and critical | within 30 days |
| Fix or mitigation, other severities | within 90 days |
| Disclosure | coordinated with you; we propose a date at triage |
| Credit | in the advisory, if you want it |
A report that the app's signing key may be exposed, or of an app signed with it that ironkeel did not release, is handled as critical, and a notice on the status page says what to do.
We take no legal action against good-faith research that respects this policy. If you are unsure whether something is in scope, ask by email before you test.