Security Policy

01 Vulnerability Disclosure Policy

InfoPeak values the security research community and welcomes responsible disclosure of vulnerabilities. If you discover a security issue in any InfoPeak service, we encourage you to report it to us.

02 Scope

The following services and assets are in scope for responsible disclosure:

• infopeak.io - main application and website
• auth.infopeak.io - authentication service
• InfoPeak Pass - browser extension
• InfoPeak VPN - mobile and desktop applications

03 Disclosure Guidelines

We ask security researchers to follow these guidelines:

• Provide sufficient detail to reproduce the vulnerability.
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or social engineering.
• Allow reasonable time (90 days) for us to address the issue before public disclosure.

04 Response Timeline

The timeline applies to reports within the scope in section 02 that meet the requirements in section 09.

05 Safe Harbor

InfoPeak will not pursue legal action against security researchers who discover and report vulnerabilities in good faith, in accordance with this policy. We consider security research conducted under this policy to be authorized and will not initiate legal claims for circumventing technological measures where the research is conducted in compliance with this policy.

06 Incident Response & Breach Notification

In the event of a security incident or data breach, InfoPeak follows these procedures in accordance with NIS2 Directive (EU) 2022/2555 and GDPR Articles 33 and 34:

• Within 24 hours: Early warning to the relevant national CSIRT (Computer Security Incident Response Team).
• Within 72 hours: Full incident notification to the supervisory authority (GDPR) and CSIRT (NIS2), including scope assessment and mitigation measures.
• Without undue delay: Affected users will be notified via email with clear information about the nature of the breach, data affected, measures taken, and recommended actions.
• Within 1 month: A final report is submitted to the relevant authorities with root cause analysis and preventive measures.

07 Security Architecture

InfoPeak employs the following security measures as part of our commitment to the Cyber Resilience Act (CRA):

• Encryption at rest: Your content is encrypted with AES-256-GCM. The keys are derived in your browser with PBKDF2-SHA256 (210,000 iterations) and never reach our servers.
• Encryption in transit: TLS 1.3 for all connections.
• Zero-knowledge architecture: Personal encryption keys are derived client-side. InfoPeak cannot access your encrypted content.
• EU-only hosting: All infrastructure located within the European Union.
• Regular security updates: Dependencies and infrastructure are continuously monitored and updated.

08 Out of scope

The following is recorded but not treated as a vulnerability. Reports covering only these items do not receive an individual response:

• Missing security headers without a demonstrated exploit - for example CSP, HSTS or X-Frame-Options on pages with no sensitive content.
• SPF, DKIM and DMARC configuration and other DNS recommendations without demonstrated spoofing.
• Self-XSS and attacks that require the victim to paste code into their own browser console.
• Clickjacking on pages with no state-changing actions.
• Missing rate limiting on endpoints that neither authenticate nor send mail.
• Version and technology disclosure, and outdated-library reports without a demonstrated attack path.
• Automated scanner output without a verified, reproducible exploit.
• Denial of service, volumetric attacks, social engineering and physical access.

09 Report requirements

A report must be readable and reproducible without us having to ask for more. Send it as text in the email itself:

• Affected URL or endpoint, and which account or role you tested with.
• Written reproduction steps. A video alone is not enough - we do not process reports where the steps exist only in a video file.
• The concrete impact. Which data or actions become available, and to whom.
• One finding per report. Bundled reports covering several unrelated findings are not triaged.
• No links to external file services. Attach evidence directly to the email.

Reports that do not meet these requirements are closed without a response. That is not a judgement of the finding - we do not have the capacity to reconstruct a report on the sender's behalf.