Security Policy

This is a free, open-source software built for the community.

We believe we have built strong security controls, but let's be real: everything is considered secure until someone hacks it for the first time.

We actively encourage security research and testing on this tool. Besides thanking you immensely for your efforts, you are completely free to evaluate the security through your own tests and exploits.

To make your life easier, our entire architecture is open-source and can be inspected at the Haltman.IO GitHub. Here is the breakdown of our core components:

Vulnerabilities must be reported via email. Please send your report to both security@haltman.io and members@proton.thc.org. Sending to either one is fine (we sync up internally), but copying both ensures the fastest response time.

We appreciate clarity. Please provide a detailed step-by-step reproduction path and attach actionable evidence (PoC). You can use the following template to speed up the triage process:

[TITLE] Type of vulnerability (e.g. RCE, xss, sqli) in [Component Name]

--- VULNERABILITY DETAILS ---
Type: (E.g. Stored XSS, Authentication Bypass, etc)
Impact: (What does an attacker gain access to?)
Component/URL: (E.g. /api/v1/auth or mail-forwarding-api)

--- STEPS TO REPRODUCE ---
1. Execute the following cURL request...
2. Observe the payload being triggered at...
3. ...

--- EVIDENCE / POC ---
(Attach logs, screenshots, terminal outputs, or a script)

--- RESEARCHER ALIAS ---
(How you want to be listed in our Hall of Fame)

Confirmed vulnerabilities will be generously rewarded, and your alias will be immortalized in our Hall of Fame! We strongly value hackers who communicate responsibly.

If you have questions, feel free to ask via email. However, we hang out and reply much faster on Telegram:

• t.me/thcorg
• t.me/haltman_group