Vulnerability disclosure
Effective from 19 October 2026
If you find a vulnerability in Zdalna, write to [email protected] (English or Polish). Describe the issue, the steps to reproduce it and the app version. Contact details are also in security.txt.
Scope
- Zdalna apps for macOS and Windows
- Browser viewer
zdalna.space/weband invitation pageszdalna.space/r/ - API
zdalna.space/api, connection serverzdalna.space/wsand the TURN relay zdalna.spacewebsite and downloads
Out of scope: denial of service (DoS), social engineering and phishing against us or our users, physical access, spam, automated scanner reports without proof of impact, third-party services (e.g. Cloudflare, Hetzner).
Testing rules
- Test with your own accounts and your own computers. Do not connect to other people's devices.
- If you come across someone else's data, stop, do not copy it and report it right away.
- Do not overload the services. Keep automated requests at a reasonable rate.
- Do not publish details until a fix is released or the agreed deadline has passed.
Safe harbor
If you act in good faith and follow these rules, we will not take legal action against you or report you to law enforcement for your research. If a third party takes action against you over such research, we will confirm that you acted under this policy.
Response times
| Acknowledgement | within 3 business days |
|---|---|
| Assessment and severity | within 10 business days |
| Fix for critical vulnerabilities | within 30 days |
| Everything else | in upcoming releases, usually within 90 days |
We keep you informed. We publish details after the fix is released, in agreement with you, and credit you in the release notes if you wish. We do not run a paid bug bounty programme.
Cyber Resilience Act (CRA)
From 11 September 2026, as the manufacturer we report actively exploited vulnerabilities and severe incidents affecting our products to the CSIRT designated as coordinator and to ENISA through the ENISA reporting platform: an early warning within 24 hours, a notification within 72 hours and a final report once a fix is available.