Report a security vulnerability

If you believe you have found a security vulnerability in an OstlerTech product, please tell us. We take reports seriously: for confirmed issues we prepare a fix or a mitigation and, where users are affected, mention it in the release notes of the version that contains it.

Send reports to guvenlik@ostlertech.com (putting "Security vulnerability report" in the subject helps us). The same address is listed in our security.txt file.

In scope

• SyncPass Android (the version published on Google Play)
• SyncPass Desktop (Windows)
• The SyncPass Chrome extension
• ostlertech.com and the services this website provides (for example the license key page)

Out of scope

• Social engineering (phishing, deception), physical attacks, and any attack directed at OstlerTech staff or users.
• Tests that disrupt the service (DoS/DDoS), heavy automated scanning and request flooding.
• What someone who has already taken over the device can do (rooted/jailbroken device, malware installed on the device, an unlocked device in someone else's hands).
• Findings without a demonstrated impact: raw scanner output, or a missing security header or flag that cannot be turned into a concrete attack.
• Third-party systems (for example Google Play, Paddle, Supabase, Cloudflare, browser stores). Please report issues in those to the company concerned.
• Versions that are no longer supported, and unpublished test builds.
• Spam and email configuration (SPF/DMARC) suggestions and similar hardening advice; we welcome these too, but they are not vulnerability reports.

While testing

• Test only with your own account, your own vault and your own devices. Do not access anyone else's data; if you reach it by accident, stop and tell us.
• Do not include real passwords, vault contents or other people's personal data in your report. Use sample data if needed.
• Do no more than needed to confirm the issue: do not download, change or delete data.
• On ostlertech.com, test only with your own license and at a normal request rate; do not try anyone else's license or record.

What to include in your report

• The affected product and version (the version number shown in the app settings), device and operating system.
• A short summary and the impact: what could an attacker do with it?
• Step-by-step instructions to reproduce it; a screenshot, short video or proof-of-concept code if you can.
• Who else you have shared the finding with, and whether you are planning a public disclosure date.
• Whether you would like your name (or a nickname) in the acknowledgements list.

If you need a secure channel, give only brief information in the first email and say so; we will agree on a way to exchange the details together.

Process and 90-day coordinated disclosure

• We aim to confirm in writing that we received your report, usually within a few business days.
• We then verify the finding, assess its impact and share an estimated timeline for a fix.
• Until a fix is published, we ask you not to share the details with third parties or publish them.
• We ask you to keep the details private for up to 90 days from the date your report reaches us. If a fix ships within that time, we agree on the disclosure date together. If a fix cannot be completed in 90 days, we will explain why and talk to you; any extension is by mutual agreement. When the 90 days are up, we ask you to tell us before you publish, and not to publish working attack code that would put users directly at risk.
• When a fixed issue directly concerns users, we say so in the release notes.

Acknowledgements

We list the name or nickname of people who report issues we then fix, only if they give us their explicit written permission. Being listed is optional; you can withdraw your permission at any time and we will remove your name.

No one is listed here yet.

What this page does and does not do

This page describes how we handle reports. It does not offer a bug bounty or any payment, and it does not give legal protection or immunity. We do aim to respond in good faith to reports made in good faith and in line with the rules above. For how personal data is processed, see our Privacy Policy.