Vulnerability disclosure policy

Report a vulnerability

Email [email protected]. Please include:

• What you found and where: the product, version or build, and the address or file
• Steps to reproduce it, and a proof of concept if you have one
• What an attacker could do with it
• How you’d like to be credited, if at all

Please don’t put real passwords or other people’s data in a report. If you’d like to send the details encrypted, say so in a short first email without them and we’ll set up a channel. Please don’t report security issues in public, such as in app store reviews or on social media.

What we promise

We keep you updated while we work on it, tell you when the fix ships, and agree a disclosure date with you. We ask that you give us 90 days from your report, or until the fix ships if that comes first, before you publish. If we need longer, we’ll explain why and ask you first.

We don’t pay cash rewards yet. With your permission, we credit every valid report in our hall of fame and in the release notes for the fix.

What’s in scope

Everything we build and ship, including preview and beta builds:

• The AdPass browser extension for Chrome, Edge, Firefox and Safari
• The AdPass iPhone and iPad app, its AutoFill extension and Safari content blockers
• The web vault (vault.getadpass.com) and the sync API (api.getadpass.com)
• This website and our email from getadpass.com
• Our shared core: cryptography, vault, sync, importers and the filter compiler
• Filter lists and scriptlets we ship, where they could run code, leak data or weaken a site’s security

We especially want to hear about:

• Anything that could reveal vault contents, keys or unlock secrets to us, our servers or anyone else
• Autofill on the wrong site, into hidden fields, or when you didn’t ask for it
• Ways around the lookalike-site warning
• Getting past sign-in, device approval or account recovery
• Any way to get code into the extension or the app

What’s out of scope

• Denial of service, load testing, or anything that slows AdPass down for others
• Social engineering or phishing of our team or users, and physical attacks
• Reports from automated scanners without a working proof of concept
• Missing security headers, cookie flags or email records without a concrete attack
• Self-XSS, clickjacking on pages with no sensitive action, and logout CSRF
• Attacks that need a fully compromised operating system, browser or device, such as a keylogger
• Bugs in services we use (Cloudflare, Microsoft Azure, Resend, Sentry, Apple, Google). Please report those to them.
• Ads or trackers that get through. That’s a broken filter: use “Something broke?” in the extension.

Rules for testing

• Only test with accounts and vaults you own. Never access, change or delete other people’s data.
• If you come across someone else’s data, stop, don’t keep or share it, and tell us right away.
• Don’t put real passwords in test vaults.
• Keep automated testing slow and gentle. No denial of service, spam or mass sign-ups.
• Keep the details private until we’ve fixed the issue and agreed a disclosure date with you.

Supported versions

We fix security issues in the latest release of each app and extension. The browser extensions and the iPhone app update automatically through their stores, and the web vault and sync service always run the latest version.

Machine-readable contact details are in /.well-known/security.txt.