Security
Found a vulnerability in Mantel? Tell us privately first, so we can fix it before anyone can abuse it. Good-faith research is welcome.
How to report
Report it in an end-to-end encrypted support ticket. Only the Mantel team can read it.
- Create a free account. You only get an account number: no email address, no payment.
- Open Support in the dashboard and start a ticket in the category “Other”.
- Start the title with “Security:” and describe the issue.
Please include
- What is affected: URL, app and version, or API endpoint
- Steps to reproduce or a proof of concept
- The impact you expect
We aim to confirm your report within 7 days and keep you posted until it is fixed. There is no paid bug bounty at the moment; with your consent we credit you once the fix is out.
Scope
In scope
- The website and dashboard on mantelvpn.com
- The client API (/api/v1)
- The Mantel apps for Windows and Android, and Mac app installs still in use
- Mantel's VPN servers and the tunnel, including the quantum-resistant key exchange
Out of scope
- Denial of service, load tests and spam
- Social engineering, phishing and physical attacks
- Services run by third parties, such as Cloudflare or payment providers
- Reports from automated scanners without a demonstrated impact
- Missing best-practice headers or settings without a concrete attack
Safe harbour
If you research in good faith and follow these rules, we will not take legal action against you and will not report you to law enforcement.
- Only test with accounts and devices that are your own.
- Do not access, change or delete other people's data. If you come across any, stop and tell us.
- Do not disrupt the service for others.
- Give us reasonable time to fix the issue (90 days) before you publish details.
- Do not keep data you obtained beyond what the report needs.
Attack protection
The website keeps no access logs. Only while mantelvpn.com is under attack, with load far above normal, does our server count requests per IP address, in memory only. An address that sends far more requests than any visitor would goes on a block list at Cloudflare, which sits in front of the website, and is removed automatically after 24 hours. The addresses of Mantel's VPN servers are never blocked, so traffic from people using Mantel is not affected. Outside an attack, no IP address is counted or stored.
Warrant canary
A signed statement about requests from authorities. If it is not renewed before it expires, assume that it no longer holds.
Not signed yet · valid until 2 February 2027
The signing key is still being set up; until then the statement is not signed.
Up to this date we have received no requests from authorities for user data and no order that obliges us to stay silent about one.