Security
If you have found a problem with this site, the demo, the verifier or the recovery kit itself, we want to hear about it, and we will not make you regret telling us.
Reporting a problem
Email security@epochcipher.com. Say what you found, where, and how to see it again. We reply to every report and tell you what we found and what we changed.
Please do not put anything secret in the report: no recovery words, card codes, passwords, or anything from a kit, yours or anyone else's. If you need to send something that must stay private, say so in a first email and we will arrange a way.
What is in scope
- This site, epochcipher.com, and the request form on it.
- The demo at demo.epochcipher.com and the verifier.
- The card format and the way a kit is made, described on this site.
Please keep to accounts and data that are yours. Do not try to reach anyone else's information, do not degrade the service for others, and do not go further than you need to show the problem.
Safe harbour
We treat security research done in good faith and within this page as authorised. We will not pursue or support legal action against you for it, and if a third party starts one, we will say so. If you are unsure whether something is covered, ask first.
Notices
No security notices have been published.
Each notice has a number (EC-SN, the year, a sequence) and is never edited once published; an update is a new notice that names the old one. They are listed here and in the Atom feed. Notices are not signed yet; when they are, the key will be published here.