Vulnerability disclosure policy
Tomelet Sync is built so that our servers only ever store what your devices have already encrypted. We value the work of security researchers who help keep it that way, and this policy explains how to report a finding and what you can expect from us.
How to report
Write to [email protected]. Please don't open a public issue or post details on social media until we have shipped a fix. If you'd like to encrypt your report, send a first e-mail with no details in it and we will reply with a key.
A useful report contains:
- what you tested: the app version and platform, or the API endpoint;
- what you expected, and what actually happened;
- the smallest reproduction you can manage: a request and response, a script or a short recording;
- the impact as you see it: whose data, how much, and what an attacker needs first.
You don't need a working exploit. A precise description of a weakness is welcome.
What we promise
| Step | When |
|---|---|
| Acknowledgement | Within 3 working days. |
| First assessment | Within 10 working days: the severity, and whether we can reproduce it. |
| Fix or documented mitigation | Within 90 days of the acknowledgement. Critical issues are handled at once and usually ship in days. |
| Disclosure | Coordinated with you: we agree a date, credit you by the name you choose (or keep you anonymous) and publish what changed. |
We explain our assessment of every report, including its severity, and keep you informed until it is resolved.
Supported versions
- The latest app version on each store: supported.
- The previous minor version: security fixes only, until the next release.
- Older versions: not supported. The sync service stays compatible with older apps, so updating is the fix.
- The sync service (
api.tomelet.app): always the current release; there is no old version to run.
Scope
In scope: the Tomelet apps (Android, iPhone and iPad, Windows, Mac, Linux and the browser app), the sync API and its infrastructure, tomelet.app and its subdomains, and the design of the encrypted vault itself, as described in the Tomelet Sync security white paper (PDF).
We are most interested in anything that would let the server, someone with access to our database, or another user read your books or notes; in sign-in and session flaws (token handling, refresh-token reuse, sign-in codes and links); in misuse of the short-lived upload and download links; and in ways for one device or account to reach another's data.
Out of scope: findings that need a rooted or jailbroken device or an already-compromised operating system; social engineering of readers or staff; denial of service by volume; missing hardening headers with no exploit path; automated scanner output without a demonstrated impact; and anything that affects only an unsupported version.
Safe harbour
We will not pursue or support legal action against anyone who reports in good faith, stays within the scope above, uses only their own accounts and test data, avoids privacy violations and service disruption, and gives us reasonable time to fix the problem before disclosing it.
Recognition
We recognize every valid report with credit under the name you choose and a written thank-you. This program does not offer monetary rewards.
What happens to your report
A report becomes a private issue at our highest priority. The fix ships with a regression test that stays in the test suite permanently, and it is reviewed independently of its author before release. Our wider engineering practice is described in the engineering and operations white paper (PDF).
Contact
[email protected] · TOMELET PTE. LTD., 60 Paya Lebar Road, #06-53, Paya Lebar Square, Singapore 409051