Julius Joska
00739ac8a0
- SECURITY.md with the reporting address and expectations; README points to security@sepot.cz and security.txt - README: FCM is the Android default since 1.2.0 when no UnifiedPush distributor is installed; status reflects the Play release - the "F-Droid" channel is not available yet and is no longer listed - CHANGELOG: unreleased fixes and security hardening
1.4 KiB
Security policy
Reporting a vulnerability
Please report security issues privately — do not open a public issue.
- E-mail: security@sepot.cz
- Web form and policy: https://sepot.cz/zodpovedne-hlaseni
- Machine-readable contact: https://sepot.cz/.well-known/security.txt
You will get an acknowledgement within 72 hours and a status update at least every 14 days until the issue is resolved. We aim to ship a fix within 30 days for issues that affect message confidentiality, authentication, or the relay's metadata guarantees, and we credit reporters in the changelog unless they prefer otherwise.
Scope
- the Flutter client (
app/), including the Signal protocol integration, local storage (SQLCipher, PIN/biometrics, duress session) and calls; - the relay (
rust/sepot-relay/): authentication, routing, push wake-ups, attachments, rate limiting, TURN credentials; - the public relay at
relay.sepot.czand the websitesepot.cz.
Please do not run denial-of-service tests, mass registrations or scans
against the public relay; a local instance (deploy/relay/) is enough to
reproduce almost everything.
What the relay can and cannot see
The threat model is documented in the README: the relay sees routing tokens, message sizes, timing and push tokens, never content or sender identity. Reports that demonstrate the relay learning more than that are the ones we care about most.