KeepSift

Vulnerability Disclosure Policy

Effective August 21, 2026. Masorix LLC welcomes reports of security vulnerabilities in KeepSift and this website. This page explains how to reach us and what we will do.

1. How to report

Email [email protected] with the subject “Security report.” Machine-readable contact details are published at /.well-known/security.txt.

Please include enough detail for us to reproduce the issue safely: the affected app version or URL, the device and operating-system version, the steps you took, what you observed, and why you believe it is a security problem. Proof-of-concept code, logs, or screen recordings help, provided they do not contain other people’s data.

Do not include your own screenshots, extracted text, search terms, or other private content unless it is genuinely necessary to demonstrate the issue. If a report requires sensitive material, say so first and we will agree a way to handle it.

2. Scope

In scope:

  • The KeepSift Android application, as distributed through Google Play.
  • This website, keepsift.com.

KeepSift for Android is a local-first app. It has no accounts, no backend service, and no cloud storage, and the current Android build declares no network permission. The vulnerabilities that matter most to us therefore concern on-device data: unintended exposure of the local index or screenshot content to other apps, weaknesses in permission handling or the screen-capture flow, unsafe handling of extracted text, entitlement or purchase bypasses, and anything that causes KeepSift to transmit data it should not.

3. Out of scope

  • Denial-of-service, volumetric, or resource-exhaustion testing.
  • Social engineering, phishing, or physical attacks against us or KeepSift users.
  • Reports affecting third-party services we rely on rather than our own code, including Google Play, Android, Google ML Kit, and Cloudflare. Report those to the relevant vendor.
  • Findings that require a rooted or already-compromised device, or an attacker who already has physical access to an unlocked phone, unless you can show a realistic escalation.
  • Automated scanner output with no demonstrated impact, and missing security headers or best-practice recommendations with no exploit path.
  • Any testing that accesses, modifies, or destroys another person’s data.

4. What to expect

We are a small company, and we would rather commit to targets we can meet than to impressive ones we cannot.

  • We acknowledge your report within 5 business days.
  • We tell you whether we consider it a valid security issue, and our initial severity assessment, within 15 business days.
  • We update you at least every 30 days while we work on a fix.
  • We tell you when a fix has shipped, and to which app version.

Where the law requires us to notify an authority — for example a regulator under applicable data-protection law, or a computer security incident response team under applicable product-security law — we will do so within the required deadlines. That obligation is independent of this policy and does not change what we owe you as a reporter.

5. Coordinated disclosure

Please give us a reasonable opportunity to fix an issue before disclosing it publicly. We ask for 90 days from your first report, and we will work to be faster than that for anything serious.

If we cannot fix an issue within 90 days we will tell you why and agree a revised date with you rather than ask for open-ended silence. If an issue is already being exploited, we may act and disclose faster. We will not ask you to delay disclosure indefinitely, and we will not treat a good-faith disagreement about timing as a breach of this policy.

With your permission we are glad to credit you by name or handle when we publish a fix.

6. Safe harbour

If you make a good-faith effort to follow this policy while researching a vulnerability, we will not pursue or support legal action against you for that research, and we will treat your activity as authorized under applicable computer-misuse law.

This protection depends on you acting in good faith: test only against your own device, accounts, and data; stop as soon as you have confirmed a vulnerability; do not access, copy, modify, retain, or destroy anyone else’s data; do not degrade the service for others; and do not extort, threaten, or publish other people’s information.

We cannot grant safe harbour on behalf of anyone else. Third parties whose services or infrastructure you touch — app stores, hosting providers, platform vendors — have their own policies, and this page does not bind them.

7. Rewards

We do not operate a paid bug-bounty programme and do not currently offer monetary rewards. We say so plainly rather than leaving it ambiguous. We offer prompt handling, honest communication, public credit if you want it, and a direct line to the people who write the code.

8. Contact

[email protected]
Telephone: +374 44 225600
Masorix LLC
Registration no. 999.110.1593071
25 Marshal Baghramyan Street, Apt. 4, Aparan 0301, Aragatsotn Province, Republic of Armenia

We do not currently publish a PGP key. If you need to send something encrypted, email us first and we will arrange a channel.