Security
Responsible disclosure
Thank you for helping keep 2Secret and its users safe. If you found a vulnerability, please tell us privately first.
How to report
Use GitHub’s private vulnerability reporting for the 2Secret repository, or e-mail [email protected]. Include:
- a description of the vulnerability and its impact;
- the steps to reproduce it, or a proof of concept;
- the version and platform you tested (app, extension, CLI, server or this website);
- how we can reach you, and whether you’d like to be credited.
Please don’t report security issues in public GitHub issues.
What we promise
- We confirm receipt within 5 working days.
- We keep you informed while we investigate and fix the problem.
- We release fixes as soon as possible and credit you in the release notes, unless you prefer otherwise.
- Security fixes are made for the latest release.
- We won’t take legal action against research done in good faith and within this policy.
What we ask
- Give us reasonable time to fix the issue before you publish anything; we aim for 90 days at most.
- Only test against your own installation and your own accounts. Never access, change or delete other people’s data.
- No denial-of-service attacks, spam or social engineering.
Scope
In scope: the 2Secret apps, browser extension, CLI, server and web vault, and the website 2secret.app.
Out of scope: servers run by other people, issues that need a device that is already compromised, and missing best practices without a demonstrable impact.
There is currently no paid bug bounty.
Our security.txt lists the same contact details in a machine-readable form.