Julius Joska
00739ac8a0
- SECURITY.md with the reporting address and expectations; README points to security@sepot.cz and security.txt - README: FCM is the Android default since 1.2.0 when no UnifiedPush distributor is installed; status reflects the Play release - the "F-Droid" channel is not available yet and is no longer listed - CHANGELOG: unreleased fixes and security hardening
35 lines
1.4 KiB
Markdown
35 lines
1.4 KiB
Markdown
# Security policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report security issues privately — do not open a public issue.
|
|
|
|
- E-mail: **security@sepot.cz**
|
|
- Web form and policy: <https://sepot.cz/zodpovedne-hlaseni>
|
|
- Machine-readable contact: <https://sepot.cz/.well-known/security.txt>
|
|
|
|
You will get an acknowledgement within 72 hours and a status update at least
|
|
every 14 days until the issue is resolved. We aim to ship a fix within 30 days
|
|
for issues that affect message confidentiality, authentication, or the relay's
|
|
metadata guarantees, and we credit reporters in the changelog unless they
|
|
prefer otherwise.
|
|
|
|
## Scope
|
|
|
|
- the Flutter client (`app/`), including the Signal protocol integration,
|
|
local storage (SQLCipher, PIN/biometrics, duress session) and calls;
|
|
- the relay (`rust/sepot-relay/`): authentication, routing, push wake-ups,
|
|
attachments, rate limiting, TURN credentials;
|
|
- the public relay at `relay.sepot.cz` and the website `sepot.cz`.
|
|
|
|
Please do not run denial-of-service tests, mass registrations or scans
|
|
against the public relay; a local instance (`deploy/relay/`) is enough to
|
|
reproduce almost everything.
|
|
|
|
## What the relay can and cannot see
|
|
|
|
The threat model is documented in the README: the relay sees routing tokens,
|
|
message sizes, timing and push tokens, never content or sender identity.
|
|
Reports that demonstrate the relay learning more than that are the ones we
|
|
care about most.
|