If you found a way to read, change or reach something in BukDesk that you should not be able to, we want to hear it.
Where to write
Say what you found, how to reproduce it, which version of BukDesk and of Windows, and what an attacker would gain. A proof of concept helps. Do not send anyone's personal data.
What is in scope
- The BukDesk app for Windows, its installer and its updater.
- The relay.
- The site bukdesk.com, its accounts and its API.
- The license and update formats.
What we ask
- Test only on computers and accounts that are yours.
- Do not disrupt the relay or the site for other people. No denial of service, no flooding.
- Do not read, change or keep data that is not yours. If you reach some by accident, stop and tell us.
- Give us time to fix it before you publish.
What you can expect
- An answer within 3 business days that we received your report.
- An honest assessment, and the reason if we disagree.
- Word when it is fixed, and thanks by name in the release notes if you want that.
There is no monetary reward for reports.
What is already known
Some limits are part of the design and are written down, so they are not vulnerabilities: see "What is not protected" in the technical paper. A way around something that page says is protected is exactly what we want to hear.
Abuse
If BukDesk was used against you, for example by someone who talked you into giving them control of your computer, write to main@bukdesk.com. We can revoke a license. We cannot tell through the relay who connected to whom, and we will not claim otherwise.