ProtonBlog(new window)
Subscribe by RSS
Illustration of vulnerability disclosure

Proton Mail’s responsible vulnerability disclosure policy

Proton Team(new window)

Share this page

Our mission at Proton(new window) is to make online safety accessible to everyone. Millions of people depend on our Proton Mail(new window) to secure their communications and keep their information private.

In order to make this high level of security accessible to all Internet users, we must work to integrate Proton Mail seamlessly with third-party products, from web browsers to mobile devices. Occasionally we find security flaws in these products that can be exploited by attackers, putting at risk the privacy and security of Proton Mail users. As any technology can contain bugs, it is the responsibility of the developer community to work together cooperatively to discover, responsibly report, and patch vulnerabilities in a timely manner.

This document describes our policies for vulnerability disclosure when we find flaws in other products and services. When developers find vulnerabilities in our products, we have an established process for reporting these: You can learn more by visiting our Proton Mail Bug Bounty program(new window) and Proton VPN Bug Bounty program(new window).

What we do when we discover a vulnerability

When we find a bug in a third-party product, we reach out directly to the vendor and describe the issue in detail. We follow the vendor’s vulnerability disclosure process whenever possible. 

Along with our bug report, we notify the vendor that we follow the industry standard of 90 days for publicly disclosing vulnerabilities to the security community. If the vendor has made a good faith effort to resolve the issue and has indicated its intent to release a patch soon, we may extend this deadline by 14 days. However, if the vulnerability is actively exploited (0-day) we may reduce the public disclosure grace period to seven days to protect users.

Oftentimes, if we understand the problem well, we may propose bug fixes or work with the product’s developers to resolve the issue. Our primary goal is to make the Internet safer, so we’re happy to collaborate toward a solution.

Summary

When Proton Mail discovers a new vulnerability in a third-party product:

  1. We inform the affected vendor, and all information is kept confidential for 90 days. 
  2. We publicly disclose the information after 90 days if we have not received feedback.
  3. If the vendor requests an extension, we publicly disclose the information after 104 days.

How to reach our security team

If you want to get in touch with us regarding a vulnerability affecting our services or products, please send a message to security@proton.me. (You may also use the PGP key for this address, which can be found at the bottom of our Security Details page(new window).) We will reply to you within one business day.

Best Regards,
The Proton Mail Security Team

Protect your privacy with Proton
Create a free account

Related articles

what is a brute force attack
On the subject of cybersecurity, one term that often comes up is brute force attack. A brute force attack is any attack that doesn’t rely on finesse, but instead uses raw computing power to crack security or even the underlying encryption. In this a
Section 702 of the Foreign Intelligence Surveillance Act has become notorious as the legal justification allowing federal agencies like the NSA, CIA, and FBI to perform warrantless wiretaps, which sweep up the data of hundreds of thousands of US citi
In response to the growing number of data breaches, Proton Mail offers a feature to paid subscribers called Dark Web Monitoring. Our system checks if your credentials or other data have been leaked to illegal marketplaces and alerts you if so. Often
Your email address is your online identity, and you share it whenever you create a new account for an online service. While this offers convenience, it also leaves your identity exposed if hackers manage to breach the services you use. Data breaches
proton pass f-droid
Our mission at Proton is to help usher in an internet that protects your privacy by default, secures your data, and gives you the freedom of choice. Today we’re taking another step in this direction with the launch of our open source password manage
chrome password manager
You likely know you should store and manage your passwords safely. However, even if you are using a password manager, there’s a chance the one you’re using isn’t as secure as it could be. In this article we go over the threats some password managers