Security & Responsible Disclosure

Report a vulnerability: security@oscou.com. We acknowledge reports within 2 business days and aim to triage within 5.

Policy version 1.0 · 5 July 2026 · see also /.well-known/security.txt

How to report

• Email security@oscou.com with steps to reproduce, affected component (site, API, web app, extension, crypto core), and impact.
• Include a proof of concept where possible. Encrypt sensitive details with our PGP key (fingerprint published in security.txt).
• Give us a reasonable window to fix before any public disclosure — we target 90 days, and we'll keep you updated the whole way.
• Please don't run tests against other people's accounts or data — use your own test accounts.

In scope

• oscou.com and the marketing site.
• The web app, browser extension, and the API (auth, sync, sharing, billing, files, breach range).
• The crypto core and its protocol design (key hierarchy, sharing/HPKE sealing, SRP).
• Anything that breaks our zero-knowledge claim — i.e. a way for the server (or a network attacker) to learn a password, private key, or plaintext.

What we care about most

• Server-side ability to decrypt vault contents, wrapped keys, or shared-collection keys.
• Authentication/authorization bypass; reading or writing another account's items, files, or memberships.
• Breaking the sharer-pays entitlement gate.
• Leaks through the breach-check endpoint beyond the disclosed 5-char hash prefix (k-anonymity).
• Cryptographic weaknesses: key reuse, nonce reuse, weak KDF parameters, downgrade, padding/oracle issues.
• RCE, SQL injection, SSRF, stored XSS, secrets in logs.

Out of scope

• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing security headers or best-practice suggestions with no concrete attack.
• Rate-limiting, denial of service, or volumetric attacks.
• Social engineering of our staff or users; physical attacks.
• Self-XSS, clickjacking on pages with no sensitive action, or issues requiring a rooted/compromised device or a malicious browser extension.
• The strength of a user's own master password (that's what our security dashboard is for).

Rewards

We run a bug-bounty program that scales with impact. Indicative ranges (USD) at launch, at our discretion and subject to quality of report:

• Critical — zero-knowledge break, mass account compromise, RCE: $2,000–$10,000+
• High — cross-account data access, auth bypass, entitlement/Secure-Send break: $500–$2,000
• Medium — scoped info disclosure, stored XSS: $150–$500
• Low — limited-impact issues: swag + hall of fame

First valid reporter of a unique issue gets the reward. We publish a hall of fame (opt-in) and are happy to coordinate CVE assignment and public write-ups after a fix ships.

How we harden Oscou

• Zero-knowledge by construction — the server only ever handles ciphertext, wrapped keys, and public keys. See the whitepaper.
• One thing to audit — a single crypto core (Rust → WASM + native), scheduled for an independent third-party audit. The report will be published here.
• Standard, audited primitives — Argon2id, AES-256-GCM, HPKE (X25519), Ed25519, HKDF-SHA-256; every record is versioned for clean rotation.
• Memory-hard key derivation — your master password is stretched with Argon2id (64 MiB, 3 passes), and we require a strong master password at signup, so stolen ciphertext is extremely expensive to attack offline.
• Privacy-preserving breach checks — our security dashboard checks passwords against known-breached corpora using k-anonymity: only a 5-character hash prefix ever leaves your device.
• Least-metadata — item names and URLs are encrypted; search runs client-side. We disclose exactly what metadata we can see in the whitepaper.

This policy will evolve as Oscou grows. It is a description of our program, not a contract. Thank you for helping keep everyone's safe corner of the universe safe.