How to report
Email security@pikonet.io with:
- a description of the problem and its possible impact;
- the steps to reproduce it, or a proof of concept;
- the app version and platform, or the affected address.
Please write in English or Russian if you can. Our security.txt has the same contact details in a machine-readable form.
Scope
- The Piko apps for Android and iOS.
- The websites pikonet.io and pikovpn.net.
Out of scope: servers and panels of VPN providers (please report to the provider), denial-of-service attacks, social engineering, spam, reports from automated scanners without a demonstrated impact, and missing best-practice settings without a practical impact.
What you can expect
- We confirm that we received your report within 5 business days and keep you informed.
- We fix confirmed problems as quickly as we can and credit you in the release notes if you wish.
- If you act in good faith and follow this page, we will not take legal action against you for your research.
- We don't run a paid bug bounty programme.
Rules for research
- Test only with your own devices and subscriptions. Don't test against VPN providers' servers or other people's data.
- Don't access, change or delete data that isn't yours. If you come across such data, stop and tell us.
- Don't disrupt our services or anyone else's.
- Give us reasonable time to fix the problem before you publish it. We suggest 90 days.