Responsible Disclosure
Found a security issue?Tell Us Directly.
We take every credible report seriously and welcome researchers who disclose responsibly — privately to us first, with reasonable time to fix it before anything is made public.
Every report reviewed
No legal action for good-faith research
Direct line to the team
Get in touch
Send Us What You Found
Include the affected system or app, the steps to reproduce the issue, and its potential impact. The more detail you can share, the faster our team can confirm and act on it — screenshots, request logs, and proof-of-concept steps are all genuinely useful.
Contact the security team
Scope
What's In Scope
If it's part of the ASTRO VPN product, it's fair game to test responsibly.
Client Applications
Windows, macOS, Linux, Android, iOS, and the browser extensions.
Server Infrastructure
The VPN network itself, including protocol implementations and server configuration.
Website & Account System
astrovpn.app, account management, and the billing flow.
API Endpoints
Any endpoint the apps or website use to talk to our backend.
Out of Scope
Denial-of-service testing, social engineering of our staff, and physical attacks on infrastructure are not permitted.
Third-Party Services
Issues in a payment processor or other third-party service should go directly to that provider.
Process
How Reporting Works
Simple, direct, and handled by an actual person on the other end.
Step 01
You find something
Document the issue, how you found it, and what it could allow — a clear write-up gets a faster response.
Step 02
You send it to us
Reach out throughContactwith the details — a real member of the security team reads every report.
Step 03
We investigate & fix
Confirmed issues are prioritized by severity, fixed, and we follow up to let you know the outcome.
The ground rules
What Responsible Disclosure Looks Like
Report privately to us first and give us a reasonable window to investigate and fix the issue before sharing it publicly. Avoid accessing, modifying or deleting data that isn't yours — proof of concept is enough, and going further than that isn't necessary and isn't protected. Testing done in good faith, within these guidelines, won't result in legal action from us.
Thank you, genuinely
Valid Reports Are Recognized
Researchers who responsibly disclose a genuine, previously unknown issue are credited (with permission) when we describe the fix, and we follow up personally to confirm it's been resolved. It's a small thing, but a real one — this program only works because people take the time to tell us instead of walking away or going public first.
To researchers
What You Can Expect From Us
Every Report Read
No auto-closed tickets — a real person on the security team reviews what you send.
Timely Acknowledgment
You'll hear back that your report was received and is being looked at, not silence.
No Legal Threats for Good Faith
Testing within these guidelines won't result in legal action from us.
Fixes Prioritized by Severity
Critical issues get treated as critical, not queued behind unrelated work.
Follow-Up on Resolution
We let you know once your finding is actually fixed, not just filed away.
Credit, With Your Permission
Happy to acknowledge your work publicly if and how you'd like it mentioned.
Ready to send your report?
Reach the security team directly and include as much detail as you can.
Frequently asked questions
You'll get an acknowledgment that your report was received, followed by updates as our team investigates. Response time depends on severity and complexity.
Right now, recognition comes in the form of a direct follow-up and public credit if you'd like it, rather than a formal paid bounty. That said, every valid report genuinely helps and is treated as a priority.
Please report privately first and give us a reasonable window to fix the issue. We're glad to coordinate on a public write-up together once it's resolved.
Avoid denial-of-service testing, accessing or modifying data that isn't yours, and social engineering our staff. A proof of concept is enough — going further isn't necessary and falls outside these guidelines.
We'll let you know it's already been identified. Independent confirmation is still useful, and we're always straightforward about the status of a known issue.
Through ourcontact page— flag it as a security report so it reaches the right team quickly.
Help Us Keep It Secure
If you've found something, we genuinely want to hear about it — and we'll follow up.
Report a Security Issue