We're grateful to the independent security researchers who help keep Crypton safe by reporting issues responsibly. 0xEr3n, for a clearly written report on session and API token lifecycle handling, along with a thorough proof of concept and thoughtful remediation suggestions. The issue has been resolved, and no user action is required.

August 2026 responsible disclosure across Crypton and Crypton BYOD Platform: SMS delivery webhooks, BYOD install reconnect, the self-hosted setup flow, and personal access token revocation. Thank you for reporting these privately and testing only on your own account and instance.