Vulnerability disclosure policy

If you think you have found a security problem in a HostSpica app or on hostspica.com, please tell us. We would rather hear about it from you first.

How to report

Email [email protected] with the subject "Security report". Please include:

• Which app or page, and which version (Settings shows the app version).
• What you found and what an attacker could do with it.
• Steps to reproduce, and your Android version and phone model if it is an app issue.

Please do not include real personal data. Use test accounts.

What we will do

• Aim to reply within 7 days to say we received it.
• Tell you whether we can reproduce it and keep you updated on the fix.
• Credit you in the release notes if you want, and only if you want.
• Ask for up to 90 days before you publish details, so a fix can reach users first. If we need longer we will explain why.

In scope

• HostSpica Authenticator, HostSpica Passkey and HostSpica Identity for Android.
• hostspica.com and its subpages.

Out of scope

• Attacks that need a rooted or already compromised phone, or physical access to an unlocked phone.
• Denial-of-service or volume-based attacks, spam, and social engineering of our staff.
• Reports from automated scanners with no demonstrated impact.
• Other companies' products or sites we link to.

Good-faith research

If you follow this policy, test only against your own accounts and devices, and do not harm other users or their data, we will treat your research as authorised and will not pursue action against you. We do not run a paid bug bounty at the moment.

Machine-readable

Our security.txt points to this page.