Security
In preparationThe full disclosure policy (timelines, scope, acknowledgements) will be published before Zynbox’s official launch.
Report a vulnerability
Think you have found a security vulnerability in Zynbox (website, app or server)? Write to us at [email protected]. Please do not make it public before we have had a chance to fix it.
In your message, include:
- what you found and what an attacker could do with it;
- the steps to reproduce the problem;
- the app version or the address concerned;
- how to reach you.
While researching:
- use only your own accounts;
- do not access or change other people’s data;
- avoid anything that could disrupt the service (denial of service, mass sending);
- do not send any message to other users.
What already protects your account
- Two-factor authentication, with recovery codes.
- An alert when your account is opened on a new device.
- An app lock code.
- Your mailbox credentials encrypted (AES-256), with a key kept outside the database.
- On Android and Windows, your session kept in the device’s secure storage.
- Each email shown in a sealed area: no program hidden in a message can run.
Check your downloads
Every published file has a SHA-256 checksum shown on the download page.