Security Policy

SpaceBox Full is made by i46 s.r.o. (Czech Republic). We want to hear about security problems in it, and we will treat you as a partner, not an adversary, if you report one in good faith.

A useful report says:

• which product, version and platform (Android, iOS, macOS, Windows or Linux);
• what you found and what it allows an attacker to do;
• how to reproduce it, with proof-of-concept files or steps if you have them;
• whether you believe it is being exploited, and if so, how you know;
• how you would like to be credited, or that you want to stay anonymous.

You do not need a complete analysis. A partial report is welcome.

What you can expect from us

When	What we do
Within 3 working days	We confirm that we received your report and tell you who is handling it.
Within 10 working days	We give you our first assessment: whether we can reproduce it, how severe we think it is, and what happens next.
After that	We keep you informed until it is fixed, and agree a disclosure date with you.

Our targets for shipping a fix, counted from when we confirm the problem:

Severity	Target
Critical	14 days
High	30 days
Medium	90 days
Low	The next regular release

These are targets, not guarantees. Releases on Android, iOS and the Mac App Store also pass through the store's review, which we do not control. If a fix will take longer, we will tell you why.

Disclosure. We ask you to keep the details private until a fix is available, or for 90 days after your report, whichever comes first, and we will agree the date with you. If a vulnerability is already being exploited, we may need to act and notify the authorities and our users sooner, and we will tell you when we do. For fixed vulnerabilities we publish a security advisory (in the release notes of the fixed version) and credit you in it, unless you prefer not to be named.

Supported versions

Security fixes are made for the latest release of SpaceBox Full on each platform. Please check that a problem still exists in the latest release before you report it, but if you are unsure, report it anyway.

We provide security updates until 1 November 2032. If that date is ever changed, it will only be moved later, and this page will say so.

Scope

In scope

• The SpaceBox Full application on Android, iOS, macOS, Windows and Linux, including its handling of keys, encryption, files received from other accounts, and the update notice.
• Our release process and the files we publish for download.
• Weaknesses in third-party components that we ship, where they affect SpaceBox Full. Please also report them to the component's maintainers.

The SpaceBox server (the "ground station": the API gateway and the storage service) is in scope as part of this product. It is run by i46 for its own services, is not provided to others, and is covered by the same policy as the app, so a report about it is handled by the same people, on the same terms, and an exploited vulnerability in it is reported once, as part of SpaceBox Full. In scope: authentication and tokens, access control, the handling of uploads and downloads, sharing and transfer, quotas and billing, the admin interface, the link between the gateway and the storage service, the installers and the build and deploy process, and weaknesses in the third-party components it ships. When you test against our production service, use only accounts and data you own, send a few requests at a low rate, never read or change another account's data, and stop as soon as you have shown the problem; testing against your own instance of the server is better. The test client login_client is out of scope.

Out of scope

• Attacks that need a device that is already rooted, jailbroken or controlled by malware.
• Social engineering of our staff or users, and physical attacks.
• Denial-of-service by overwhelming volume, and automated scanner output with no demonstrated impact.
• Missing hardening that has no demonstrated effect, for example a missing security header on a page that holds no data.

Rules for testing

Please:

• test only against accounts and data that you own, or have the owner's permission to use;
• stop as soon as you have shown the problem, and do not read, change, delete or keep other people's data;
• do not degrade the service for other users.

If you follow this policy in good faith, we will not take legal action against you for it, and we will say so to anyone who asks.

Rewards

We do not currently offer monetary rewards. We will credit you in the advisory, if you wish, and we are grateful for the work.

Languages

You can write to us in English or Czech.