KeyhatchSecurity
How to report a vulnerability, what we promise, and where to read how Keyhatch works.
Report a vulnerability
Write to [email protected] with the Keyhatch version, your macOS, iOS or watchOS version, what you did and what happened. We confirm within 2 business days and give a first assessment within 7 days. Please do not test against other people's devices and do not run load tests against relay.keyhatch.app.
Machine-readable contact: /.well-known/security.txt. There is no bug bounty; we credit reporters in the advisory unless they prefer to stay anonymous.
Support period
Security updates for 5 years after the purchase of a 1.x license, and for the current versions of the iPhone and Watch apps.
Cyber Resilience Act
Keyhatch is treated as an important product of class I under Regulation (EU) 2024/2847. Actively exploited vulnerabilities and severe incidents are reported to the ENISA single reporting platform within the deadlines of Article 14.
No external audit
Keyhatch has not been audited by a third party. Instead, three independent internal review passes are made (after the agent core, after remote approval, before 1.0) and published with their findings and fixes.