Found a security problem?
Thank you. Please tell us privately first, so we can fix it before anyone is put at risk.
How to report
Email Email us with what you found, how to reproduce it, and which version of the app or which part of our service it affects. Screenshots or a short video help.
Please don't include anyone else's private data, and don't test on vaults or shares that aren't yours.
What we promise
- We'll reply within 5 working days, and keep you updated until it's fixed.
- We'll fix serious problems as fast as we can, and tell users plainly when an update matters for their safety.
- We won't take legal action over research done in good faith within these guidelines.
- With your permission, we'll thank you by name on this page once the fix is out.
In scope
- The Vault This Android app (and the iPhone app when it's out).
- Our sharing server (vaultthis-relay.vaultthis.workers.dev).
- This website, for anything that could put users at risk.
Not in scope
- Attacks that need an already-compromised or rooted phone, or physical access to an unlocked, open vault.
- Denial of service, spam, or social engineering of our staff or users.
- Problems in Google Play, Google Drive, Cloudflare or Android themselves (please report those to them).
How Vault This is built
The design is described on How your files are protected. We're happy to share more detail with researchers.
Thanks
No reports yet. Yours could be the first.