Security
Responsible disclosure
If you have found a vulnerability in Willful, we want to hear about it — and we would rather you tell us than not.
How to report
Email security@willful.in with "Security" in the subject.
Include enough for us to reproduce it: what you did, what happened, and what you expected. A proof of concept helps. Please report in English.
The details
What we commit to
- We acknowledge your report within 3 working days.
- We tell you our assessment, and whether we are fixing it, within 10 working days.
- We keep you updated until it is closed, and tell you when the fix ships.
- We will credit you by name if you would like that, and not if you would not.
- We will not pursue legal action against anyone acting in good faith under this policy.
What we ask
- Give us reasonable time to fix the issue before telling anyone else.
- Use only your own accounts and your own data. Do not access, modify or delete anyone else's — this is an inheritance product, and the data in it belongs to families at the worst moment of their lives.
- No denial of service, no spam, no social engineering of our team or our users, and no physical attacks.
- Do not run automated scanners against the live service. Ask us first.
In scope
willful.inand the pages under itapi.willful.inadmin.willful.inandadmin2.willful.in- The Willful Android app
Out of scope
- Reports from automated tools with no demonstrated impact.
- Missing hardening headers, or weak TLS ciphers, without a working exploit.
- Anything requiring a rooted device, a compromised OS, or physical access to an unlocked phone.
- Social engineering, and phishing of our staff or users.
- Rate-limit findings on endpoints that already rate-limit.
Especially interesting to us
Willful is end-to-end encrypted: your vault is encrypted on your device under a key derived from your passphrase, which never reaches our servers. Anything that undermines that claim is the most valuable report you can send us. Specifically: a way for the server to read vault contents, a flaw in the passphrase derivation or key wrapping, a way to obtain or bypass a nominee key, or a way to trigger a release without passing the identity checks.
No bounty, yet
We do not currently pay for reports. We are a small team and would rather say so plainly than imply otherwise. Credit, a fast response, and our genuine thanks are what we can offer today.
Machine-readable
/.well-known/security.txt, per RFC 9116.