Security and vulnerability reporting
How to protect accounts and passes and report a possible CheckTau vulnerability.
What CheckTau protects
CheckTau uses accounts, permissions and server checks to restrict access to records. Protect your account and passes, and report any suspected unauthorised access using the contact on this page.
Protect your account
Use a unique password and keep your device updated and locked. Do not share accounts or temporary passwords. In Profile on the website or Settings in the mobile apps, you can change your password and close all sessions, including the current one. If you suspect unauthorised access, notify your organisation. Closing a session does not erase records or remove files or emails already copied.
Links, passcodes and QR credentials
Obtaining a pass requires a link and passcode. The server checks expiry, attempts and single use. Successful verification may consume the link even if the pass is not displayed. The QR is a separate credential, reusable to identify the participant at activities. Do not publish links, passcodes, QR credentials or screenshots. If exposed, request a review of the credential: link expiry does not by itself invalidate the QR.
Passwords and sessions
The server uses password and passcode hashes and digests of refresh credentials. On the Web, the browser holds an opaque identifier and sensitive session data is encrypted on the server. In production, the cookie is HttpOnly, Secure and restricted to the app host. Private responses instruct caches not to store them. This is not end-to-end encryption: the server processes records to provide the service.
Mobile devices
iOS stores credentials in Keychain, protected for access while the device is unlocked and without iCloud synchronisation. Android encrypts them with Android Keystore keys and excludes that storage from app backups. The camera processes QR codes on the device; CheckTau does not record or upload images. The privacy policy explains Android SDK diagnostics. These measures do not automatically protect screenshots, exported files, sharing apps or emails.
Wallet passes and links
Apple and Google links contain temporary authorisations and are confidential. The server rechecks the participant and QR when issuing a pass. Signing keys stay on the server; the Google link carries data to the provider and does not anonymise it. A saved PNG or pass can be copied. It is static and is not remotely deleted when a link expires or the QR is replaced.
Report a vulnerability
Write to [email protected]. Describe the affected feature, approximate date and time, minimal steps and possible impact. Include the app or browser version and previously redacted screenshots if helpful. Do not send passwords, passcodes, tokens, full access links, QR credentials or third-party data. For sensitive information, first ask for an appropriate channel.
Stop checking if other people’s data appears. Do not extract data, maintain access, interrupt the service or test third-party systems. This channel does not grant general testing authorisation or establish rewards, immunity or guaranteed response times. Attendance errors, expired links and account enquiries go to the organisation or Support. Avoid disclosing details that could enable exploitation while the issue is being reviewed.
Report a vulnerabilityOther incidents and emergencies
For account, pass or attendance problems, contact your organisation or Support. If someone faces immediate danger, contact the emergency services and your organisation; do not wait for a reply to an email.