Security Research

Research, reviewed.
Findings, welcomed.

ProxySmart maintains an open channel for qualified security researchers. This page documents the technical review programme, responsible disclosure process, and the terms under which we engage with the research community.

First response
Within 3 business days
Disclosure framework
ISO/IEC 29147:2018 · CERT/CC
Legal posture
Safe-harbour for good-faith research

Independent scrutiny makes software better.

ProxySmart treats rigorous, good-faith research as a contribution — whether the subject is a vulnerability in our code, a design decision open to challenge, or a claim about what our platform does and does not do.

We commit to engaging researchers directly, responding promptly, acknowledging contributions publicly where welcomed, and providing access to the artefacts needed to verify technical claims under structured, mutual terms. This page sets out how that works in practice.

Technical review programme

For researchers who want to verify technical claims about ProxySmart's architecture — including what the platform does and does not include — we provide access to the relevant artefacts under a mutual non-disclosure arrangement.

What is made available

Under signed NDA, qualified researchers receive access to:

  • Android application package (APK) used for device enrolment
  • Server-side binaries for the ProxySmart platform
  • Architecture documentation describing system components and their boundaries
  • Written clarifications on specific technical questions raised during review

What is not in scope

The following remain proprietary and are not included:

  • Device driver components and low-level hardware integration layers
  • Customer deployments, keys, or operational data of third-party operators
  • Commercial terms, pricing structures, or customer lists
  • Infrastructure unrelated to the platform itself

How the review works

Step 01
Introduction
Researcher contacts ProxySmart with a brief statement of scope, methodology, and institutional or professional affiliation.
Step 02
NDA
Mutual non-disclosure agreement is signed. Scope of review, permitted outputs, and publication rights are agreed in writing.
Step 03
Access
Artefacts in scope are provided. Researcher conducts independent technical review over the agreed window.
Step 04
Dialogue
Findings are discussed. Corrections, if any, are implemented. Researcher may publish within the terms of the NDA.

Responsible disclosure

For security vulnerabilities — including bugs, misconfigurations, and unintended behaviours — ProxySmart operates a coordinated disclosure process aligned with recognised industry standards.

ISO/IEC 29147:2018
ISO/IEC 30111:2019
CERT/CC Guide to CVD
FIRST Ethics for CSIRTs
How to report
Send a description of the finding to [email protected] with sufficient detail to reproduce. PGP-encrypted email accepted; key available on request.
Acknowledgement
Within 3 business days of receipt, the researcher receives a named point of contact and an initial assessment of the report.
Triage & fix
Reports are triaged by severity. Critical issues are addressed within 30 days; other issues within 90 days. Researchers are kept informed at each stage.
Embargo
Standard embargo period is 90 days from triage, extendable by mutual agreement where remediation requires coordination with downstream parties.
Credit
Researchers are credited in disclosure notes and in the acknowledgements section of this page, unless they request otherwise.
Safe harbour
ProxySmart will not pursue legal action against researchers who act in good faith, respect user privacy, avoid service disruption, and follow the disclosure process described here.

Bug bounty programme

Compensation for security researchers who identify vulnerabilities in ProxySmart's code and deployed infrastructure.

In preparation · Q4 2026

A structured programme is being developed.

Rewards will be scaled by severity, validated under a published rubric, and settled through the programme's payment rails to avoid cross-border remittance friction for individual researchers.

Scope — security findings only. The bounty programme applies exclusively to verifiable security issues: vulnerabilities, misconfigurations, authentication bypasses, data exposure, and other defects with demonstrable security impact. General commentary, architectural critique, policy analysis, and independent research output remain welcome through the Technical Review Programme above, but are not eligible for bounty compensation.

In the interim, valid security findings reported through the responsible disclosure process are eligible for acknowledgement, direct engagement with our engineering team, and discretionary compensation assessed case by case. Researchers who report qualifying issues now will be invited to the structured programme at launch.

Research wall

Public acknowledgement of researchers whose findings have led to corrections, improvements, or meaningful engagement with ProxySmart.

— — —

The wall is currently empty.

This section will list researchers chronologically as engagements complete. If you have submitted a report and would like to be credited here, please indicate this in your correspondence.

Common questions

Who qualifies for the technical review programme?

Independent security researchers, academic institutions, infrastructure intelligence firms, and analysts conducting good-faith technical assessment. Affiliation with a recognised research group, relevant publication history, or a professional reference are helpful but not strictly required. The NDA structure is designed to work for individual researchers as well as organisations.

Can I publish findings after a review?

Yes. Publication rights are agreed as part of the NDA and are not unreasonably restricted. The standard arrangement permits publication of findings, methodology, and conclusions after a short pre-publication review window, which exists solely to correct factual errors — not to suppress unfavourable conclusions. If a researcher disagrees with our position after review, we encourage publishing the disagreement and our response side by side.

What if a third-party report has already made technical claims about ProxySmart?

We encourage independent verification. Where a published report has characterised the platform's capabilities, a qualified researcher can conduct an independent review and confirm, qualify, or contradict those claims against the actual codebase and documentation. ProxySmart's detailed response to recent third-party research is available here, alongside an architectural diagram that lays out the platform's functional boundaries.

What is explicitly out of scope for review?

The device driver layer, which is proprietary and handles low-level integration with specific hardware modems, is outside the review scope. It is also not relevant to verifying the platform's architectural claims — the absence of SMS origination, voice primitives, USSD handling, and SIM-box interconnect functionality can be fully verified through the application, server binaries, and architecture documentation that are made available.

How does ProxySmart handle law-enforcement requests?

Lawful, properly scoped requests from competent authorities are handled through formal channels, reviewed by legal counsel, and responded to in accordance with applicable jurisdictions. ProxySmart does not provide ad-hoc access outside of such processes. Researchers reporting findings with potential law-enforcement relevance are asked to flag this in their initial contact.

What about findings that are not security bugs — for example, policy or design feedback?

We welcome these as well, through the same contact point. Non-security feedback is not governed by the disclosure process described above, but a named contact will respond within the same timeframe and engage substantively. Criticism of design decisions, abuse-surface analysis, and policy feedback have all led to concrete changes in the past.

Can a report be submitted anonymously?

Yes. Anonymous reports are accepted and triaged on technical merit alone. We cannot acknowledge the researcher publicly, offer bounty compensation, or engage in follow-up dialogue without an identifiable correspondent — but the issue itself will still be investigated and fixed.

Get in touch

A single channel handles all research correspondence — technical review requests, vulnerability reports, policy questions, and engagement with recent published research.

Research correspondence
First response SLA
3 business days
Encrypted correspondence
PGP public key available on request
For the press
Contact the same address with "PRESS" in the subject line