If you find a security problem in SipherMail, we want to hear about it. This page explains how to report it and what happens next. SipherMail is operated by Sipher Ltd.
How to report#
Send your report to the contact listed in our security.txt file at https://siphermail.com/.well-known/security.txt. Do not open a support ticket for a vulnerability, because tickets are visible to more people than a security report should be.
Include:
- What you found and which product it affects (web app, iPhone or Android app, mail server, marketing site).
- Steps to reproduce, with the URL, request or screen involved.
- What an attacker could do with it.
- Your name or handle if you want credit.
Use test accounts you created yourself. Do not include real customer data in a report.
Scope#
In scope:
- The SipherMail web app and its APIs.
- The iPhone and Android apps.
- Our mail service: authentication, mailbox access, and delivery handling.
- The siphermail.com website.
Out of scope:
- Attacks on other people’s accounts or data.
- Denial of service, volumetric testing and spam.
- Social engineering of our team or customers, and physical attacks.
- Missing best-practice headers or settings with no demonstrated impact.
- Issues in third-party services we use. Report those to the vendor.
What to expect#
- We aim to acknowledge your report within 3 working days.
- We will tell you whether we can reproduce it and how serious we think it is.
- We will keep you updated until it is fixed, and tell you when it is.
- We ask that you do not publish details until we have fixed the issue or agreed a date with you.
Good-faith research#
If you follow this policy, we will not start legal action against you or ask others to, for research that:
- Stays within the scope above.
- Uses only your own accounts and data.
- Stops as soon as you reach another person’s data, and does not copy, change or delete it.
- Does not degrade the service for other people.
- Is reported to us promptly and privately.
This is a statement of intent, not a legal waiver. It does not cover anything outside our control, such as a third party’s rules.
Rewards#
We do not run a bounty program and do not promise payment. We may thank you publicly if you agree. Any reward is at our discretion.