Report a security problem

Headway Tech LLC. This page is also published as /.well-known/security.txt (RFC 9116).

The short version. If you find a way the app or this site leaks something it says it doesn’t, or any other security problem, write to [email protected] with "Security" in the subject. A person reads it.

What to include

What you saw and how to see it again: steps, the app version (Settings, About), the iPhone model and iOS version.
For a network finding: the domain or address, and the request if you captured it. The app’s complete list of addresses is on What leaves your phone; anything not on that list is a bug by definition.
For a detection finding (a device, tracker or spyware trace the app misses or misnames): the device or sample, and what the app showed.

What happens

You get a reply within three working days saying whether we can reproduce it.
A confirmed leak of data the app says it doesn’t send is fixed in the next update, and the address list and privacy policy are corrected the same day. The fix note in the App Store names the problem.
We will credit you by the name you choose once it is fixed, or keep you out of it if you prefer.
We don’t pay bounties yet. If that changes it will be announced here first.

In scope

The iPhone app and its extensions (the Safari blockers, the call directory, the text filter, the share sheet check and the widget), App protection, the VPN server and sign-up desk, the email check and camera map services on headwaytech.app/api, this site, and the files the app downloads from it.

Out of scope, please

Testing on anyone else’s phone, account or network; anything that degrades the VPN or site for other people; and findings in Apple’s, Quad9’s, Have I Been Pwned’s, OpenStreetMap’s or adsb.lol’s own services, which belong to them.

What we promise not to do

We won’t take legal action against anyone reporting in good faith who stays within the scope above and gives us a reasonable time to fix before publishing.

Headway Tech LLC · [email protected]