Reporting a vulnerability
If you've found a security problem in RetuVPN, email [email protected]. We read every report.
Last updated 23 October 2026
What to send
- the affected app, version or server address;
- steps to reproduce the problem;
- what an attacker could do with it.
What we'll do
- Acknowledge your report within 2 business days.
- Tell you whether we can reproduce it and keep you updated until it's fixed.
- Credit you in the release notes when the fix ships, if you want to be named.
Scope
In scope: the RetuVPN apps, retuvpn.com, our account service and our VPN servers.
Out of scope: denial-of-service testing, social engineering of our staff or users, physical attacks, and services run by Stripe, Apple, Google or Microsoft. Report those to the company concerned.
Safe harbour
We won't take legal action against you for research that follows this policy in good faith. That means you:
- access only the data you need to show the problem, and never other users' traffic;
- don't degrade the service for anyone else;
- give us 90 days to fix the problem before you disclose it publicly, unless we agree otherwise.
Machine-readable contact details are in our security.txt.