LocalGateKeys Vulnerability Disclosure Policy

Effective date: 19 October 2026

We welcome reports from anyone who finds a security problem in LocalGateKeys. This policy explains how to report one and what you can expect from us.

1. How to report

Email security@localgatekeys.app. Please include:

• the product and version affected (Windows app, browser extension, iPhone app, update service or website);
• a description of the issue and its impact;
• steps to reproduce, or a proof of concept;
• your name or handle for the credit, if you would like one.

Please do not report security issues in public issue trackers or on social media before we have fixed them.

2. Scope

In scope:

• the LocalGateKeys Windows app, including the vault format, unlock methods, backups, transfer packages, sync and Windows app fill;
• the native messaging host and the local connection between it and the app;
• the LocalGateKeys browser extension for Chrome and Edge;
• the LocalGateKeys iPhone app, once released;
• the update feed, release signing, the licence service, licence keys and the revocation list;
• the website at localgatekeys.app.

Out of scope:

• attacks that require malware, a debugger or an administrator already in control of the user's Windows session, a compromised browser or operating system, or physical access to an unlocked device. These are outside our published threat model, though we still want to hear about practical attacks that make them easier;
• denial of service, spam, or volumetric attacks against our services;
• social engineering of us or our users, or physical attacks;
• vulnerabilities in third-party products (Windows, Chrome, Edge, cloud-drive services, the merchant of record, Cloudflare); please report those to the vendor;
• missing security headers or best-practice findings on the website without a demonstrated impact.

3. Rules for testing

• Test only with your own vaults, licences and devices. Never access, modify or delete data that is not yours.
• Do not run automated scanners against our update service or website at a rate that degrades them.
• Do not attempt to obtain licence-signing or release-signing keys by attacking us, our accounts or our providers.
• Give us a reasonable time to fix the issue before disclosing it, as described below.
• Do not demand payment in exchange for not disclosing a vulnerability.

4. What we commit to

• We will acknowledge your report within 3 working days.
• We will give you an initial assessment within 10 working days.
• We aim to release a fix or mitigation within 90 days of the report. If we need longer, we will explain why and agree a timeline with you.
• We will keep you informed of progress and tell you when the fix is released.
• With your permission, we will credit you in the release notes and the security advisory.

5. Coordinated disclosure

We ask that you wait until a fix is released, or 90 days have passed since your report, whichever comes first, before publishing details. We may agree a different timeline with you, for example if the issue is already being exploited. We publish an advisory for every confirmed vulnerability that affects released versions.

6. Safe harbour

If you act in good faith and follow this policy, we consider your research to be authorised, we will not pursue or support legal action against you for it, and we will make that clear if a third party brings action against you for activity covered by this policy. This does not authorise testing of third-party systems.

7. Rewards

We do not currently run a paid bug bounty. We are grateful for every report and will credit researchers publicly unless they prefer not to be named.

8. Contact

Security reports: security@localgatekeys.app. Machine-readable contact details: https://localgatekeys.app/.well-known/security.txt.