Report a vulnerability

Last updated: 20 Oct 2026

Found a security vulnerability in Zquady? Thank you for telling us. This page explains what is in scope, how to reach us and what happens after you report. Zquady is published by Zquady e.U. of Ottensheim, Austria.

1. What is in scope

  • the Zquady app for iOS and Android,
  • the website zquady.com with all its pages, including the share pages under /z/ and /u/,
  • our interfaces at auth.zquady.com, which the app uses for sign-in, data and features,
  • the mail setup of the domain zquady.com, such as SPF, DKIM, DMARC and MTA-STS.

Out of scope are the services of other providers we use, such as Apple, Google, Supabase, Cloudflare or Microsoft. Please report a vulnerability there directly to that provider. Reports without any recognisable impact, spam and questions about your account do not belong here either: for account questions, support@zquady.com will help, and illegal content is quickest to report right in the app.

2. How to report

Write to security@zquady.com. If something does not get through, you can also reach us at support@zquady.com. English or German are both fine. It helps if you tell us:

  • where the vulnerability is: app and version, platform, address or feature,
  • what you observed and how we can reproduce it, step by step,
  • what someone could do with it,
  • screenshots or a short proof of concept, if you have one,
  • how we can reach you with questions.

If a vulnerability is being exploited right now or data is openly accessible, please start the subject line with “URGENT – ”. We handle such reports first.

We currently do not offer a PGP key for encrypted email. So please do not send us passwords, access keys or other people’s data; a description is enough.

3. Please keep to these rules

  • Test only as far as needed to show the vulnerability.
  • Use only your own accounts. Do not access, change or delete other people’s data. If you come across such data anyway, stop at that point, delete anything you stored and tell us.
  • Do not disrupt the service: no load tests or denial-of-service attacks, no mass scans, no spam.
  • Do not deceive users or us (social engineering, phishing), and do not try to gain access to premises or devices.
  • Do not plant malicious code or leave backdoors behind.
  • Do not share or publish the vulnerability before it is fixed or we have agreed on a date.

4. What happens after you report

  1. Receipt: We confirm receipt of your report within 72 hours.
  2. Assessment: We look into the vulnerability, assess how serious it is and tell you what happens next and when we expect to fix it.
  3. Fix: We fix the vulnerability as quickly as possible and keep you updated. If it affects the app, the fix comes with an update.
  4. Disclosure: If you would like to write about the vulnerability, please agree the timing with us. This is usually once it is fixed, typically around 90 days after your report.

If a vulnerability affects personal data, we also check our obligations under the General Data Protection Regulation and, where required, inform the data protection authority and the people affected.

5. No bounty

We do not run a bug bounty programme and do not pay for reports. We are grateful, though, for every report that makes Zquady safer.

6. Contact

Zquady e.U.
Linzer Straße 17, 4100 Ottensheim, Austria
Vulnerabilities: security@zquady.com
Authorities: legal@zquady.com

We use what you send us only to handle your report. More about this in our privacy policy. Our reporting contact is also published in machine-readable form in the file security.txt (RFC 9116); full provider details are in the imprint.