VeraCrypt is an open-source utility used for on-the-fly encryption. It can create a virtual encrypted disk within a file or encrypt a partition or the entire storage device with pre-boot authentication.

Reporting a security issue in VeraCrypt

To report a security issue in VeraCrypt, e-mail veracrypt@idrix.fr.

Accepted reports must follow VeraCrypt's Security Model.

PGP Public Key for contact.

Internet Bug Bounty Qualification

You must disclose a previously unknown security vulnerability directly to the project maintainers, as described above. This program ONLY accepts already fixed security vulnerabilities in VeraCrypt. If you don't have a CVE yet, then please do not submit a report.

Only critical vulnerabilities that demonstrate complete compromise of the system's integrity or confidentiality are eligible for a bounty - typically Arbitrary Code Execution or equivalent impact. While we encourage you to submit all potential issues, lower severity issues are not in scope at this time.

Additionally, any bugs that can cause broad information disclosure or decryption of information within containers or encrypted drives will be considered.

Awards are increased for fixes that include giving the developers any custom tools that you developed to locate the bugs, as it provides a longevity boost to your work and eliminates the chances for regressions or reintroducing similar bugs of the same class. Make sure your tools have documentation and proper commenting in the code so that the developers can utilize / enhance / improve upon your work in the future to receive increased awards.

The project maintainers have final decision on which issues constitute security vulnerabilities. The Internet Bug Bounty Panel will respect their decision, and we ask that you do as well.

Only versions currently supported by the upstream project are eligible. Please verify your issue is present in a current release before submission. Note that other forks of TrueCrypt and any fork of VeraCrypt code are not eligible.

It's important to keep in mind that not all submissions will qualify for a bounty, and that the decision to award a bounty is entirely at the discretion of the Panel.