Tell us about a security problem
If you have found a weakness in KazaVPN, we would rather hear it from you than read about it somewhere else.
Report a security issue
Open to everyone, with or without a KazaVPN account. We keep only the address you give, for our answer.
We have your report
Your reference
Every mail about this report carries it, and our answer comes to the address you gave.
- We acknowledge your report within three business days.
- We send you a first assessment within ten business days: what we think it is and how serious we hold it to be.
- We fix it within ninety days, or we send you a written plan with a date on it.
On this page
Where to send it
Use the form above, or write to security@kazavpn.com, with what you found, the steps to see it happen again, and what you think it lets somebody do.
The same address is published at /.well-known/security.txt, so a tool that goes looking for it finds it.
What to report
Anything that could let somebody reach an account, read what should be private, or make the service do something it should not.
- A way into an account that is not the account holder's own.
- A way to read or change something that belongs to somebody else.
- A way around a limit, a payment or a check that is meant to hold.
- Anything on our website, in our apps or in the service that looks like a security mistake, even if you are not certain it is one.
What we promise
We acknowledge your report within three business days.
We send you a first assessment within ten business days: what we think it is and how serious we hold it to be.
We fix it within ninety days, or we send you a written plan with a date on it.
If you want credit, we name you on this page once the fix is out. If you would rather not be named, you are not named.
Credit
Everybody who reported something and asked to be named is listed here. Tell us the name you want to be shown by, and it goes up when the fix is published.
Nobody is listed yet. You could be the first.
What is out of scope
These are not reports we act on, and nothing on this page covers you for testing them.
- Anything meant to take the service down or flood it, and load testing of any kind.
- Social engineering, phishing or pressure of any sort aimed at the people who work here or at our customers.
- Anything that reaches a real customer: their account, what they do, or the connection they are on.
- Automated scanning that slows the service down or makes it worse for the people using it.
Safe harbour
Stay inside your own account and your own data, take only what you need to show the problem, and give us the time above before you publish, and we will treat what you did as good-faith research. We will not seek legal action against you for it, and we will say so in writing if anybody else does.
We do not have a paid vulnerability reward program. This page does not promise payment for reports. If that changes, we will update it.
Questions about reporting
Do I need a KazaVPN account to report?
No. Anyone can use the form on this page or write to security@kazavpn.com, whether they use KazaVPN or not.
Will you take legal action against me?
Not for good-faith research inside the safe harbour above: stay in your own account, take only what you need to show the problem, and give us time to fix it before you publish.
Do you pay for reports?
No, we do not have a paid reward program. If you want credit, we name you on this page once the fix is out.