Security Overview & Responsible Disclosure

How we protect your account

• Encryption in transit: connections to the web app use TLS (HTTPS), with HTTP Strict Transport Security in production. Mail exchanged with other providers uses TLS where the other server supports it.
• Passwords: stored only as one-way hashes by our mail server. New passwords are checked against known data breaches using Have I Been Pwned's k-anonymity method.
• Sessions: while you are signed in, your mailbox password is held in a server-side session encrypted with AES-GCM. The session cookie is HttpOnly and Secure.
• Two-step verification: authenticator app codes (the secret is stored encrypted) and single-use backup codes (stored as one-way hashes).
• Passkeys: phishing-resistant sign-in using WebAuthn. We store only your passkey's public key.
• Sign-in history: you can review recent sign-ins and active sessions, and sign out other devices, in Settings.
• Automated protection: sign-up and password reset include bot protection, and incoming mail is scanned for spam and malware.
• Tracking protection: external images in emails are blocked by default.
• Optional end-to-end encryption with OpenPGP. See End-to-End Encryption.

What we do not claim

Unless you use end-to-end encryption, your messages are stored on our servers in a form our systems can read, so they can be searched, filtered and delivered. We do not currently claim any independent security certification. [Details of encryption at rest for mail storage (to be confirmed)]

No online service can be perfectly secure. You can help by using a unique password, turning on two-step verification or passkeys, and keeping your devices up to date.

Reporting a vulnerability

If you believe you have found a security vulnerability in Viremail, please tell us via the contact details on our website. Our security.txt file lists our current security contact.

Please include:

• a description of the issue and its potential impact;
• step-by-step instructions to reproduce it;
• any proof-of-concept code, screenshots or request logs;
• how you would like to be credited, if at all.

We aim to acknowledge reports within [acknowledgement time, e.g. 5 working days (to be confirmed)] and to keep you updated as we investigate and fix the issue.

Rules for testing

• Only test against accounts you own or have explicit permission to use.
• Do not access, change or delete other people's data. If you encounter it, stop and tell us.
• Do not carry out denial-of-service attacks, spam, social engineering or physical attacks.
• Do not use automated scanners that generate large volumes of traffic.
• Give us reasonable time to fix the issue before sharing details publicly.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not take legal action against you, and we will not ask law enforcement to investigate you, in relation to that research. If a third party takes legal action against you for activity that followed this policy, we will make it known that your actions were authorised.

This safe harbour does not cover activity that breaks the law or goes beyond what is needed to demonstrate the issue.

Rewards

We do not currently run a paid bug bounty programme and cannot promise payment for reports. With your permission, we are happy to thank you publicly for valid reports.