We take security seriously and welcome reports from the security community.
Reporting a vulnerability
Report a suspected vulnerability through our contact form (choose the Security disclosure topic), or by email to security@pswd.ca. Please include enough detail to reproduce the issue: affected URL or component, steps, and impact.
Scope and good-faith safe harbor
Testing against our production systems that degrades service, accesses another person's data, or exfiltrates data is out of scope. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.
What to expect
We aim to acknowledge a report promptly and keep you updated as we investigate. As a pre-launch product we are not offering a paid bounty yet; we are grateful for responsible disclosure and will credit reporters who wish to be named.
A note on our design
pswd is zero-knowledge: your vault is encrypted on your device and we never hold the key that decrypts it. That design limits the blast radius of many server-side issues, but it does not make us immune — please still report anything you find.