Report a security vulnerability

Have you found a security vulnerability in WebDonkey, WebDonkey Editor or WebDonkey Pages, in our online shop at shop.webdonkey.io or on our website webdonkey.io? Thank you for reporting it to us. We take every report seriously and look at it promptly.

How to report a vulnerability

Write to info@webdonkey.io with the subject “Security vulnerability”. This helps us most:

the affected app and its version (in the app under Settings) or the affected address,
the steps to reproduce the vulnerability,
what an attacker could achieve with it,
whether you have indications that the vulnerability is already being exploited.

Please do not send us credentials or personal data of other people. Test only with your own accounts, licences and devices and do not run load or stress tests against shop.webdonkey.io or webdonkey.io.

What happens next

We usually confirm receipt within three working days.
Within ten working days you receive a first assessment from us.
We keep you informed until the vulnerability has been fixed and, if you wish, credit you in the release notes.

Please publish details only once an update is available, or agree the timing with us.

How we inform users

We list fixed security vulnerabilities in the release notes of the app concerned. If a vulnerability is being actively exploited, we also inform users via the update notice in the app, on our Discord server and Premium customers by email, and we report it, as the Cyber Resilience Act (Regulation (EU) 2024/2847) requires, via ENISA's reporting platform to the German Federal Office for Information Security (BSI).

This information is also available in machine-readable form at https://shop.webdonkey.io/.well-known/security.txt.

Version 2026-10-20 · Last updated: 20 October 2026