Security & Disclosure

Our Security Architecture

SovereignShield is designed with a minimal attack surface. Because we collect almost no user data, the consequences of a Kragworks infrastructure breach are limited to subscription metadata — not usage data, not location, not traffic contents.

Vulnerability Disclosure Process

• Email security@kragworks.net with a description of the vulnerability
• Include steps to reproduce, affected versions, and potential impact
• We acknowledge receipt within 48 hours
• We investigate and confirm within 10 business days
• We patch confirmed vulnerabilities and notify you when resolved
• We credit researchers in release notes unless anonymity is requested

Scope

In scope for vulnerability reports: SovereignShield iOS app, Kragworks.net website, SovereignShield daemon software, Node hardware firmware.

Out of scope: Social engineering attacks, physical attacks on hardware, vulnerabilities in Apple's iOS or App Store infrastructure, issues requiring physical device access that the user has not granted.

What We Ask

We ask that researchers act in good faith: do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability; do not perform denial-of-service testing; do not disclose publicly before we have had a reasonable opportunity to patch.

Contact

security@kragworks.net — for security disclosures only.
privacy@kragworks.net — for privacy inquiries.