Responsible disclosure

If you've found a security problem in anything 2keys runs, thank you. Please tell us before anyone else, and give us a fair chance to fix it.

In scope

• 2keys.sh, twokeys.io and chilegalcyber.com, including their subdomains.

Our clients' systems are not in scope. Report those to the client directly.

How to report

• Our reporting mailbox is being set up. The address will appear here, and in security.txt, the day it's live.
• Send what you found, how to reproduce it, and what an attacker could do with it. We'll acknowledge within three business days and keep you posted until it's fixed.
• Tell us if you'd like credit when it's fixed. We don't run a paid bounty.

Please don't

• Access, change or delete data that isn't yours, or keep any you come across.
• Degrade service: no denial-of-service, spam, or automated scanning at volume.
• Use social engineering or physical access against us or anyone we work with.
• Publish details before we've fixed it, or 90 days have passed, whichever comes first.

Our side

If you act in good faith and follow this page, we will not pursue or support legal action against you for your research, and we'll work with you to understand and fix the issue quickly.

Machine-readable contact details are in /.well-known/security.txt.