Security
Found something? Tell us.
We would much rather hear about a problem from you than read about it somewhere else. Write to security@qikksstudio.com with enough detail to reproduce it. There is no bounty programme. We are a small studio and would rather promise nothing than promise money we might not have.
In scope
- The Zip VPN and Zip Browser VPN Android apps, in their current Play Store releases
- Anything that leaks traffic outside the tunnel, or that fails open when it should fail closed
- Our server directory and the API the apps talk to
- This website, including anything that could be used to impersonate us
Out of scope
- The third-party VPN servers the apps connect through, which we do not operate
- Findings that only apply to a rooted or otherwise modified device
- Reports produced solely by an automated scanner, with no working proof
- Denial of service, volumetric testing, spam, or social engineering of anyone
- Missing hardening headers with no demonstrated impact
What we promise.
We will acknowledge you within three working days
A human reply, not an auto-responder, confirming we have the report and whether we can reproduce it.
We will keep you updated while we fix it
You will hear when we have a fix, and again when it reaches Google Play. Store review adds time we do not control.
We will credit you, if you want it
Tell us the name or handle to use. We are equally happy to keep a report anonymous.
We will not come after you
We will not pursue legal action, or ask anyone else to, over research done in good faith and within the scope on this page.
How we build.
Our apps hold no accounts, so there is no credential store to breach and no password database to lose. What each app keeps lives on the device and goes away when you clear its storage.
Traffic between the apps and our server directory runs over TLS, and the apps ship a network security configuration that refuses to fall back to plaintext. Where an app can fail closed, it does: Zip VPN’s Kill Switch blocks traffic rather than letting it out while a tunnel is down.
The open-source components each app is built from are listed in full, per app, alongside their licences: Zip VPN and Zip Browser VPN and Ludo Arena.
For anything that is not a security issue, the support page is the faster route.