Security contact
Security contact
Email contact@vaultever.app with the subject Security report. If possible, include the affected version, device and operating-system version, a concise description, reproduction steps and the impact you observed.
Please remove personal content from screenshots and never include a vault pattern, recovery phrase, private key or unredacted vault file in a report.
Responsible disclosure
- Give us a reasonable opportunity to understand and address the issue before public disclosure.
- Test only accounts, devices and files that belong to you or that you are explicitly authorized to test.
- Avoid actions that could destroy data, degrade service, access another person’s content or create unnecessary risk.
- Do not use social engineering, spam, denial-of-service activity or physical attacks as part of a report.
- There is no bug bounty at this time. We will review reports as we can.
What the app protects
For local vaults, file contents, filenames and thumbnails are encrypted on the iPhone. A vault key is protected by a pattern processed with Argon2id, and AES-GCM integrity checks reject altered protected data.
This does not cover originals left in Photos or Files, readable exports, screenshots or copies made outside Vaultever. Encrypted app data may also be included in device backups according to iOS settings.
Independent review
No independent security audit has been completed. Internal tests and implementation review are not an independent audit or certification.
Updates
This page will be updated when the security contact or the product’s security design changes.
