ProShield VaultTechShield Technologies welcomes clear, reproducible reports that help improve ProShield. This policy is an initial coordinated-disclosure process, not a paid bug bounty.
Test only accounts, vaults, files, and devices you own or have explicit permission to use. Stop immediately if you encounter another person’s information.
1. How to report
Email support@proshieldvault.com with the subject “Security Report.” Include the affected product and version, environment, impact, reproduction steps, and any safe proof of concept. Redact credentials and personal information.
If ordinary email is not suitable for your report, ask for a protected submission method before sending sensitive technical material. A dedicated security mailbox and public encryption key are planned but are not available yet.
2. In scope
Good-faith research may cover the current ProShield Android application, the web application at app.proshieldvault.com, the marketing and legal site at proshieldvault.com, and ProShield-created encrypted backup or sharing formats when tested using data you control.
Third-party services—including Google, Google Play, browsers, hosting providers, and Have I Been Pwned—are governed by their own disclosure programs and are not authorized for testing under this policy.
3. Research guidelines
Use the minimum interaction required to demonstrate the issue. Avoid privacy violations, service disruption, data destruction, persistence, lateral movement, and access beyond what is necessary to prove impact. Preserve evidence without retaining user information.
Allow TechShield a reasonable opportunity to investigate and correct a confirmed issue before public disclosure. Coordinate disclosure timing, especially where users need time to install an update.
4. Activities not permitted
Do not use denial-of-service attacks, high-volume automated traffic, social engineering, phishing, credential stuffing, physical attacks, malware, extortion, threats, or testing against another person’s account or device. Do not degrade availability, delete or change information you do not own, or access unrelated Google Drive content.
Reports limited to automated scanner output, missing best-practice headers without demonstrated impact, rate-limit observations without a practical security consequence, or issues that require an already fully compromised device may be closed without remediation.
5. How reports are handled
TechShield will review reports based on reproducibility, exploitability, and potential effect on confidentiality, integrity, or availability. We may request clarification or a safer proof of concept. Resolution time depends on severity, complexity, affected platforms, and coordinated release requirements.
This policy does not promise payment. It also does not authorize activity that violates applicable law or third-party terms. TechShield intends to work constructively with researchers acting in good faith and within this policy; formal legal safe-harbor terms are still under review.
6. Recognition and disclosure
With the reporter’s permission, TechShield may credit a researcher after a confirmed issue is resolved. Security advisories may describe impact, affected versions, remediation, and acknowledgement without publishing details that would unnecessarily endanger users.