Security and vulnerability reports

Last updated: 5 October 2026.

CrossPin encrypts Pin content and attachments between paired devices during transfer. Pairing and reconnecting authenticate devices, and Premium purchases are verified separately. These protections do not make a compromised device safe or prevent a trusted recipient from keeping content it has received.

Keep your devices updated, use a screen lock, install CrossPin from official sources and pair only devices you control and trust. CrossPin does not claim to be unhackable, independently certified or a cloud-backup service.

Files from paired devices

A file can contain malware even when it arrives from a paired device or travels encrypted. CrossPin does not provide antivirus scanning or certify attachments as safe. Do not run programs, enable document macros or open unexpected files unless you trust their source. A compromised paired device can send harmful files.

CrossPin treats active file types as attachments rather than executing them in the editor. Desktop downloads are marked with the platform's downloaded-file trust information. File-integrity checks detect transfer corruption; they are not malware checks. Operating-system file handlers and image decoders also need current security updates.

Report a vulnerability

Email support@crosspin.app with the subject Security report. Include the affected version, the impact and steps needed to reproduce it. Use a small demonstration with your own data. Do not email real users' content, credentials or a public exploit containing secrets.

Please test only devices and data you control. Do not disrupt services, perform denial-of-service or mass scanning, access other people's content, extract data, or use social engineering. Stop if you encounter another person's information and report the minimum details needed to locate the problem.

We will investigate good-faith reports and coordinate remediation and disclosure. Please allow reasonable time for investigation before publishing exploit details. We do not promise a bounty or grant permission to test third-party infrastructure, stores or providers. This policy is not a waiver of other people's legal rights.