Trust Center · Disclosure
Vulnerability disclosure policy
We value the work of security researchers. If you found a vulnerability, tell us, and let us fix it together and protect our users.
How to report
Send your finding by email, in English or Turkish. If possible, include:
- 1The affected component and address (web app, API endpoint or extension version)
- 2Steps to reproduce and a proof of concept, if you have one
- 3The likely impact: which data or which accounts are affected
- 4How you would like to be credited in the acknowledgments (optional)
- Please do not attach other users' data or encrypted vaults to your email.
Security contact
Contact details are also published in RFC 9116 format:
muhammed@aliguc.com
Scope
In scope
- The web app at auth.aliguc.com (vault, sign-in, recovery, organizations) and this website
- The API on the same origin (/api/*)
- The MGVault browser extension (Firefox and Chromium builds)
- The cryptographic design published on this site and the claims in the whitepaper
Out of scope
- Social engineering, phishing and physical attacks
- Denial of service (DoS/DDoS), volumetric attacks and load testing
- Vulnerabilities in third-party services (for example payment, email or hosting providers); please report those to the provider
- Findings that require a rooted or jailbroken, malware-infected or physically compromised device
- Issues that only occur in unsupported or outdated browsers
- Automated scanner output without a demonstrated security impact, header-only suggestions and version disclosure
- Behavior documented as a known limitation in the whitepaper (unless you show a new attack path)
Research rules
- 01
Only use your own accounts and organizations you created for testing.
- 02
Do not access, modify or delete other users' data. If you access it by accident, stop and tell us.
- 03
Avoid tests that could degrade the service (heavy automated scanning, brute force, DoS) and respect rate limits.
- 04
Do not disclose the issue publicly or share it with others until it is fixed.
- 05
Do not take more data than needed to demonstrate the issue, and delete any data you obtained once you are done.
Safe harbor for good-faith research
We consider security research carried out in good faith and in line with this policy to be authorized. We will not take legal action or file a complaint against you because of such research.
If a third party takes action against you over research that followed this policy, we will make it clear that your research complied with this policy.
This safe harbor applies to the extent permitted by applicable law and covers only our own systems; we cannot authorize testing of third-party systems. If you are unsure whether something is in scope, ask us first.
Our response-time targets
We are a small team. We share these times as targets we work to meet, not as a binding service level.
3 business days
Acknowledgment
We confirm that we received your report and are looking into it.
10 business days
Initial assessment
We validate the finding and share its severity and our plan for a fix.
90 days
Coordinated disclosure
After the fix ships we disclose together with you. If it needs to take longer, we explain why and agree on a new date.
We keep you informed along the way. Fixes that affect users are listed in the security changelog.
Bounty program
We do not offer a paid bug bounty at this time. A program is planned and will be announced on this page when it starts. If you wish, we will credit your contribution by name in the acknowledgments.
Acknowledgments
We credit researchers here who reported an issue under this policy and asked to be named.
The list is empty so far. Yours could be the first name on it.
Get started
Start your vault in under a minute
Free for personal use. Your keys are created on your device — right now, in your browser.