Security contact

Last updated: 4 November 2026

If you find a vulnerability in Toriinthecat software (Vault-ZIP and others), please tell us here.

Where to report

[email protected] (start the subject with "[Security]")

It helps to include:

• the software and its version (Vault-ZIP shows it under Settings → About)
• the operating system and its version
• the steps to reproduce it, and what happened
• the file used, if it holds no one's secrets or personal data

Please do not send real passwords, private keys or other people's files.

What happens next

1. We confirm that we received your report within 7 days.
2. We check it and tell you which versions are affected and how serious it is.
3. We prepare a fix and publish, in the release history on this site, the affected versions and the fixed version.
4. Please keep the details private until the fix is out; we agree on the date with you. We credit you by name only if you wish.

Out of scope

• Someone with administrator rights, or malware running as the same user, reading data on the device (a compromised OS login cannot be defended by an application)
• Short or guessable passwords falling to brute force

A machine-readable contact is also published: /.well-known/security.txt