Vulnerability Disclosure

How to report

Email security@novash.app with:

• what is affected (the app, the AutoFill extension, the server, or this website), and its version;
• the steps to reproduce the issue, with a minimal proof of concept;
• the impact you believe it has;
• how you would like to be credited, if at all.

Never include a real master password, recovery key, or anyone else's data in a report. You can write in English or Arabic.

What we commit to

• We aim to acknowledge your report within 5 business days.
• We will keep you informed while we confirm and fix the issue.
• We will tell you when it is fixed, and credit you publicly if you want us to.
• Where the law requires it, including the EU Cyber Resilience Act, we also report actively exploited vulnerabilities to the competent authorities.

Novash does not currently pay rewards for reports.

In scope

• The Novash app for iPhone and iPad, including its AutoFill extension
• The Novash account and sync service
• This website, novash.app

Out of scope

• Denial-of-service or load testing, spam, and social engineering of anyone
• Physical attacks, or attacks that need an unlocked device or a jailbroken device
• Reports from automated scanners without a demonstrated impact
• Missing best practices with no security impact
• Issues in services we use (such as Apple, Cloudflare, or Supabase), which should go to those companies

Rules for testing

• Test only against accounts you created yourself.
• Never access, change, or delete other people's data. If you reach it by accident, stop, do not keep a copy, and tell us right away.
• Do not degrade the service for other users.
• Give us reasonable time to fix the issue before you share it publicly. We will agree a date with you, and normally ask for no more than 90 days.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not take legal action against you for it, and we will not report it to law enforcement. If someone else takes legal action over research that followed this policy, we will make it known that your work was authorized. This safe harbor covers Novash only. We cannot give permission on behalf of other companies.

If you are unsure whether something is allowed, ask us at security@novash.app before you test. Our machine-readable contact file is at /.well-known/security.txt. Read more about how Novash protects you on our Security page.