Vulnerability Disclosure Policy

Effective Date: 2026-09-11

Upon Vault is operated by Mesg Ltd, a private limited company registered in England and Wales (Company Number: 15167645), with its registered office at 86-90 Paul St, London, EC2A 4NE, United Kingdom.

We build a vault that people trust with the keys to their estate. If you have found a way to break that, we would much rather hear it from you than from a customer. This policy explains how to reach us, what we will do with your report, and what we promise not to do to you.

To those taking the time to investigate the security of our service or design of our inheritance vaults, thank you in advance. We’re genuinely grateful for all third party reviews.

1. How to report

Email security@uponvault.com.

If you would prefer not to use email, the current set of channels — including any messenger addresses we accept reports on — is published in machine-readable form at /.well-known/security.txt.

To encrypt a report by email, we publish an age recipient at /security-age-key.txt. age is a single Go binary with no keyring and no web of trust, so there is nothing to set up:

curl -sO https://uponvault.com/security-age-key.txt
age -a -R security-age-key.txt report.txt > report.txt.age

Then send report.txt.age to security@uponvault.com. We do not publish an OpenPGP key.

Please do not report security issues through public channels: GitHub issues, social media, or our general support address.

2. What to include

A good report is one we can reproduce. Where you can, please tell us:

• What the issue is, and what an attacker could achieve with it.
• Step-by-step reproduction instructions, including the URL, account, or vault involved.
• The date and time of your testing, and the source IP address you tested from, so we can separate your traffic from a real attack.
• Any proof-of-concept code, screenshots, or request captures.
• How you would like to be credited, if we publish an acknowledgement.

If English is not your first language, write in whatever language you are comfortable with and we will translate.

3. Scope

In scope:

• uponvault.com and my.uponvault.com, and any other subdomain we operate.
• The Upon web application, its API, and our client-side cryptography.
• The cryptographic design described in our security whitepaper. Design flaws are as welcome as implementation bugs.

Out of scope:

• Services operated by our providers rather than by us, including our payment provider, our email provider, and our DNS and hosting providers. Please report those to the provider directly.
• Findings from automated scanners without a demonstrated impact, including missing headers, cookie flags, and TLS configuration preferences.
• Denial of service, volumetric testing, and anything that degrades the service for other users.
• Social engineering of our staff, customers, or suppliers, and physical attacks.
• Reports that depend on a compromised device, a malicious browser extension, or a user who has already been phished.
• Self-XSS, clickjacking on pages with no sensitive action, and missing rate limits with no demonstrated consequence.

If you are unsure whether something is in scope, ask us before testing.

4. Rules for testing

Test against your own account and your own vaults. Do not access, modify, or retain data belonging to anyone else. If you come across another person’s data by accident, stop, do not save a copy, and tell us in your report.

Do not run automated scanners against our production systems, do not attempt to degrade the service, and do not attempt to pivot from a finding into our internal infrastructure. Prove the vulnerability exists and then stop, we do not need you to demonstrate the maximum possible damage.

5. What we promise

• We will acknowledge your report within 3 working days.
• We will give you our assessment, whether we consider it a vulnerability, and how severe, within 10 working days.
• We will keep you updated as we work on a fix, and tell you when it ships.
• We will credit you by name or handle when we publish a fix, unless you would rather stay anonymous.

We do not currently run a paid bug bounty. We are a small company and we would rather be honest about that than imply a reward we cannot pay. That does not make your report less welcome.

6. Safe harbour

If you make a good faith effort to follow this policy, we will not pursue or support legal action against you in connection with your research. Specifically, we will not bring a claim under the Computer Misuse Act 1990, under data protection law, or under our Terms of Service for your testing, and if a third party brings an action against you for research conducted within this policy, we will make it known that your activity was authorised.

This protection applies to your research, not to what you do afterwards. Extortion, threatening to publish, using accessed data for any purpose other than demonstrating the issue, or deliberately harming our customers falls outside it.

Safe harbour cannot bind third parties. If your testing touches a system we do not operate, it is outside our authority to authorise.

7. Coordinated disclosure

We ask that you give us 90 days from your report before publishing, or until a fix has shipped, whichever comes first. If a fix is taking us longer than that, please talk to us. We would rather agree an extension with you than have a deadline pass in silence.

We will not ask you to sign a non-disclosure agreement as a condition of reporting, and we will not use a fix timeline to bury an issue indefinitely.

8. Changes to this policy

We may update this policy. The version in force for your report is the one published when you sent it.