EN
ČeštinaEnglishPolskiDeutsch

Security

Report a vulnerability

Found a security issue in the Talkey app or on our servers? Write to security@talkey.com.

What to send

  • the product, app version (Settings → Support) and operating system,
  • a description of the issue and steps to reproduce it,
  • the impact as you see it,
  • how we can contact you.

Write in English or Czech. The report does not have to be complete – sooner is better than perfect. Attach screenshots and proof-of-concept code; do not send real data of other users.

What we will do

  • We confirm receipt within 3 working days.
  • Within 10 working days we tell you how we assess the issue and what we will do.
  • We keep you informed about the fix.
  • We ship the fix in the next update, critical issues first.
  • Once the fix is out, we publish a security advisory. If you wish, we credit you by name.
  • We report actively exploited vulnerabilities and severe incidents to the national CSIRT and ENISA under Regulation (EU) 2024/2847 (Cyber Resilience Act).

What we ask of you

  • Do not publish details before the fix is released – unless agreed otherwise, no later than 90 days after your report.
  • Test only on your own account and your own data. Do not access data of others; if you come across it, stop and tell us.
  • Do not degrade our servers (no DoS), do not send spam, and do not use social engineering against our staff or customers.

Good-faith research

If you act in good faith and follow this policy, we will not take legal action against you for this research.

We do not currently pay bounties.

Scope

  • the Talkey app for Windows, macOS, iOS and Android,
  • Talkey Classic for as long as we provide it,
  • Talkey servers and web services in the talkey.com domain, including the talkey.com website.

Out of scope: third-party services (App Store, Google Play, mail servers, Firebase) and automated scanner findings without a verified real impact.

Support and updates

Talkey receives security updates on Windows, macOS, iOS and Android until at least December 2031. Fixed vulnerabilities are listed in our security advisories.