Report a vulnerability
Found a security issue in the aloo app or on our servers? Write to security@talkey.com.
What to send
- the product, app version (shown in Settings) and operating system,
- a description of the issue and steps to reproduce it,
- the impact as you see it,
- how we can contact you.
Write in English or Czech. The report does not have to be complete – sooner is better than perfect. Attach screenshots and proof-of-concept code; do not send real data of other users.
What we will do
- We confirm receipt within 3 working days.
- Within 10 working days we tell you how we assess the issue and what we will do.
- We keep you informed about the fix.
- We ship the fix in the next update, critical issues first.
- Once the fix is out, we publish a security advisory. If you wish, we credit you by name.
- We report actively exploited vulnerabilities and severe incidents to the national CSIRT and ENISA under Regulation (EU) 2024/2847 (Cyber Resilience Act).
What we ask of you
- Do not publish details before the fix is released – unless agreed otherwise, no later than 90 days after your report.
- Test only on your own account and your own data. Do not access data of others; if you come across it, stop and tell us.
- Do not degrade our servers (no DoS), do not send spam, and do not use social engineering against our staff or customers.
Good-faith research
If you act in good faith and follow this policy, we will not take legal action against you for this research.
We do not currently pay bounties.
Scope
- the aloo app for iOS and Android,
- servers and web services used by aloo in the talkey.com and aloo.cz domains, including the aloo.cz website.
Out of scope: third-party services (App Store, Google Play, mail servers, Firebase) and automated scanner findings without a verified real impact.
Support and updates
aloo receives security updates on iOS and Android at least until December 2031. Fixed vulnerabilities are listed in our security advisories.