Skip to content

Security advisories

Resolved issues, oldest to newest. All listed advisories are closed. Report a new issue through the contact form.

Session cookies did not use the __Host- prefix, which would have let a cookie set on a parent domain shadow ours. No exploitation seen. We moved all session cookies to the __Host- prefix with Secure, HttpOnly and SameSite=Lax. Closed.

VRA-2023-01 · v0 token scope · medium · 2023-04-11

A v0 token could, in a narrow case, be used after the account that created it had changed its password. The v1 rewrite tied token validity to the account and dropped the v0 behaviour. v0 was switched off entirely on 30 June 2023. Closed.

VRA-2024-01 · Export path handling · low · 2024-09-17

Folder names containing a slash could place a file outside its folder inside the export zip. Files were never stored at an unsafe path on disk (storage uses random identifiers); this was cosmetic to the zip layout, but we fixed it so the manifest and archive always agree. Closed.

VRA-2025-01 · Share token length · low · 2025-09-09

Share tokens were random but shorter than necessary. A researcher noted the margin was thinner than it should be. We lengthened new tokens; existing links were unaffected and kept working until they expired. No link was guessed. Closed.

VRA-2026-01 · Access-code timing · low · 2026-06-24

The access-code check on share links was not constant-time, leaking a tiny timing signal. We made the comparison constant-time. Closed.