Security policy

Reporting a vulnerability

Email hypersharp-security@comtrade.com. Do not publish the finding before we have shipped a fix.

Include what you can of:

• the product and version: the desktop or mobile app, the Privacy Shield browser extension, hs-server, hs-admin, this portal or the license server;
• the steps to reproduce, or a proof of concept;
• the impact as you understand it.

Do not send real personal data, license keys or credentials. A description and the steps are enough, and we ask for more when we need it.

What to expect

• An acknowledgment within five business days.
• A contact who keeps you informed while we investigate and fix.
• A fix shipped as a security update to every affected product, on a timeline agreed with you. We aim to publish within 90 days of the report and ask for more time only when a fix needs it.
• Credit in the release notes, if you want it.

Fixed vulnerabilities are named in the notes of the release that carries the fix.

Scope

• The HyperSharp desktop and mobile app (Windows, macOS, Android, iOS).
• The HyperSharp Privacy Shield browser extension (Chrome, Firefox, Safari).
• hs-server and hs-admin, and the Docker images that ship them.
• This portal, downloads.hypersharp.ai, and its update API.
• The license server, license.hypersharp.ai.

Out of scope: denial of service and load testing against the portal or the license server, social engineering, physical attacks, and vulnerabilities in third-party services we do not operate. Report those to their owner; we help where we can.

Safe harbor

Research done in good faith under this policy is authorized. We will not take legal action against you or refer you to law enforcement for research that stays within the scope above, avoids privacy violations, data destruction and degraded service, and gives us reasonable time to fix before disclosure. If a third party takes legal action against you for work that complies with this policy, we will confirm that you acted under it.