Personal Vault

Vulnerability Disclosure Policy

Personal Vault exists to keep people’s most sensitive information safe. If you’ve found a weakness, we want to hear about it — and we promise to work with you in good faith.
Effective:
14 September 2026
Last updated:
14 September 2026
On this page
  1. 1.Introduction
  2. 2.Scope
  3. 3.Out of scope
  4. 4.What we especially want to hear about
  5. 5.How to report
  6. 6.Our commitments
  7. 7.Safe harbour
  8. 8.Rewards and recognition

Introduction

This policy explains how security researchers can report vulnerabilities to us, what systems are covered, and how we will respond. For an overview of how Personal Vault protects your data, see our Security page.

Scope

The following are in scope:

  • The Personal Vault Android app — the latest version published on Google Play (package com.personalvault.app).
  • The Personal Vault website at personalvault-web.vercel.app.

Out of scope

  • Google services used by the app (Google Play Billing, Google Drive, Google Sign-In, Google Mobile Ads, ML Kit) — please report these directly to Google.
  • Social engineering or phishing of our staff, contractors or users.
  • Physical attacks against people, property or devices.
  • Denial-of-service or volumetric attacks.
  • Attacks that require a rooted or otherwise compromised device, or physical access to an unlocked device — unless they bypass the vault’s encryption.
  • Missing best-practice HTTP headers or configuration without a demonstrated security impact.
  • Unverified output from automated scanners.
  • Clickjacking on pages that have no sensitive actions.

What we especially want to hear about

  • Cryptographic flaws — weaknesses in key derivation, key wrapping or our use of SQLCipher.
  • Backup files — anything that breaks the confidentiality or integrity of .pvbackup files.
  • Authentication bypass — defeating the PIN, biometric unlock or failed-attempt lockout.
  • Data leakage — vault data exposed through logs, the clipboard, notifications, screenshots or to other apps.
  • IPC and exported components — activities, services, receivers or providers that other apps can abuse.

Bypassing purchase verification to unlock Pro features is low priority: we still appreciate reports, but it does not put user data at risk.

How to report

Email khanmudassir1248@gmail.com. Please include:

  • a description of the vulnerability and its potential impact;
  • step-by-step instructions to reproduce it;
  • the app version, Android version and device model (or browser, for the website);
  • a proof of concept, screenshots or a screen recording, where possible.

Please do not include real vault data belonging to anyone other than yourself. If you prefer to send your report encrypted, ask us and we will arrange encrypted email.

Our commitments

When you report a vulnerability in line with this policy, we will:

  • acknowledge your report within 3 business days;
  • triage it and give you an initial assessment within 10 business days;
  • keep you informed of our progress;
  • aim to fix valid vulnerabilities within 90 days, depending on severity and complexity;
  • coordinate public disclosure with you once a fix is available;
  • credit you in our release notes or hall of thanks — if you would like to be credited.

Safe harbour

We consider security research carried out in good faith and in line with this policy to be authorised. We will not pursue or support legal action against you for such research. To the extent we are able, we waive claims under anti-circumvention and computer-misuse laws — including the US Digital Millennium Copyright Act (DMCA) and Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act 1990 and India’s Information Technology Act, 2000 — in respect of research that complies with this policy.

To qualify for safe harbour, you must:

  • not access, modify or delete other people’s data;
  • test only on devices, accounts and data that you own or are authorised to use;
  • not degrade or disrupt our services or other users’ experience;
  • give us reasonable time to fix the issue before disclosing it publicly;
  • not demand payment or make threats (no extortion).

We cannot authorise testing of systems we do not own, including Google’s. Safe harbour cannot bind third parties or public prosecutors.

Rewards and recognition

We do not currently run a paid bug bounty programme. We are genuinely grateful for every valid report, and with your permission we will publicly thank you for helping keep Personal Vault users safe.