Responsible disclosure

Reporting a security issue.

A report that reaches the right place quickly is worth more than a report that is perfectly formatted. Send it, and we will work out the detail with you.

  • Where to send
  • What to include
  • What to expect
  • What not to send

01 · Where to send it

One address, monitored.

Send security reports to security@tunnelsovereign.com. The same address is published in /.well-known/security.txt.

02 · What to include

Enough for someone to reproduce it.

None of this is mandatory. Send what you have.

  • What you observed, and what you expected instead.
  • The steps, request or input that produced it.
  • The component and surface: Tunnel Mobile, Tunnel Command, Tunnel Relay, or this website.
  • Version or build identifier if you have it.
  • Your assessment of impact, and whether you believe it is exploitable in a deployment.
  • How you would like to be credited, or that you would prefer not to be.

03 · What to expect

Acknowledgement, assessment, and a coordinated fix.

  • Acknowledgement that the report was received.
  • An assessment of whether the issue is reproducible and what it affects.
  • Coordination with you on disclosure timing where a fix is required.
  • Where a deployment is affected, notification through the deployment agreement rather than publicly first.

04 · What not to send, and what not to do

Two boundaries that matter more here than elsewhere.

This page describes how we intend to handle reports. It is not a legal safe-harbour undertaking, and it does not grant authorization to test systems operated by others.