Security
Reporting a vulnerability. Email dev@flowlabapps.com with “Security” in the subject. We aim to acknowledge within three business days. Please give us a reasonable chance to fix an issue before publishing it.
1. Our security model
We run no servers holding user data, so the usual breach story — an exposed database, a leaked credential dump — does not apply to us. There is no user database anywhere. What matters instead is the security of the code on your own device, and of the small number of places where an app touches a network at all.
- Keybound derives its key with Argon2id and encrypts its vault with XChaCha20-Poly1305, with all cryptography implemented in Rust and the master key never handed to the interface layer.
- Keyclave encrypts each document under its own key, wrapped by a master key derived from your password, with key material held in the device Keychain marked when unlocked, this device only.
- Neither master password can be recovered by us. That is deliberate, and it is what makes the encryption meaningful rather than decorative.
- Several apps ship without any networking entitlement, so the operating system blocks a connection whether or not the code attempts one.
2. How to report
Email dev@flowlabapps.com. A useful report usually includes:
- Which app or which page, and the version or the date you tested.
- The device and operating system version.
- What the issue allows an attacker to do, and what access they need first.
- Steps to reproduce, and a proof of concept if you have one.
Please do not include real personal data, a real password, a recovery key or the contents of a real vault in your report. Use test data.
We aim to acknowledge within three business days, to tell you our assessment within ten, and to keep you updated until it is resolved. If you would like credit in the release notes, say so and we will include the name or handle you prefer.
3. Scope
In scope: the Flowlab Apps apps listed on this site, and this website.
Out of scope: denial of service and volumetric testing; social engineering of us or of our users; physical attacks; spam and mail-configuration reports without a demonstrated impact; findings that require a jailbroken, rooted or already-compromised device; automated scanner output with no demonstrated exploit; and issues in Apple's, Google's or Cloudflare's own infrastructure, which should go to them.
4. Safe harbour
If you research in good faith under this policy, we will not pursue or support legal action against you. Good faith means: you avoid privacy violations, data destruction and service degradation; you only ever access data belonging to your own test accounts and devices; you stop as soon as you have demonstrated the issue; and you give us a reasonable period — ordinarily 90 days — to publish a fix before you disclose publicly.
If a third party brings action against you for work that genuinely followed this policy, we will make it clear that your research was authorised.
5. Rewards
We are a very small independent developer and we do not operate a paid bug bounty. We can offer prompt attention, honest credit in the release notes if you want it, and a real conversation with the person who wrote the code. We would rather say that plainly than imply a payment that is not coming.
6. Contact
- Email: dev@flowlabapps.com
- Machine-readable policy: flowlabapps.com/security.txt