PsiDriveTest only accounts, devices, and harmless synthetic files that you control.
Help us investigate security issues safely.
We welcome good-faith reports that help protect PsiDrive users. Begin with a minimal, non-destructive description and allow us time to reproduce and address the issue.
What to include.
- A concise description of the suspected issue and its potential impact.
- The affected public URL, app platform, and app or browser version.
- Minimal reproduction steps using only accounts and synthetic files you control.
- An email address if you permit us to ask follow-up questions.
Do not include passwords, OTPs, active session tokens, encryption keys, complete transfer links, private file content, or personal data in the initial report.
Testing boundaries.
Do not perform denial-of-service testing, automated high-volume scanning, spam, social engineering, or actions that increase cost unnecessarily.
Do not access, download, modify, or retain another person's data. Stop when you have enough evidence to explain the issue.
Our handling commitments.
Reports submitted through the secure form receive an immediate reference. Email reports sent to [email protected] are routed to our monitored security inbox. We aim to acknowledge critical reports within one business day, high-severity reports within two, medium-severity reports within three, and low-severity or hardening suggestions within five business days.
Broad plaintext or key exposure, authentication bypass, remote code execution, or unrestricted cross-user file access. Immediate containment review.
Account takeover or significant cross-user access that requires meaningful preconditions. Priority investigation.
Limited data exposure, integrity impact, or abuse that requires several prerequisites. Scheduled investigation.
Hardening recommendations, low-impact information exposure, or best-practice gaps. Backlog and review.
These are acknowledgement targets, not fixed remediation deadlines. Reproducibility, affected users, exploitability, and available mitigations determine the final severity and response plan. This policy does not promise a bug bounty or fixed payment.
Public disclosure should wait until a fix is available and users have had reasonable time to update. Legal safe-harbor language cannot override applicable law, but PsiDrive will not pursue action against research that follows these boundaries and is conducted in good faith.