Report vulnerabilities privately.

Use the repository's private security advisory form. Include the affected version, platform, impact, reproducible steps, and the smallest safe proof. Do not include real people's private messages, recovery secrets, signing keys, or production capabilities.

Scope

High-value areas include account and device identity, encrypted local storage, MLS and post-quantum layering, recovery and linking ceremonies, capability authorization, relay isolation, key transparency, public-signature verification, updater signatures, and bypasses of stated trust-receipt guarantees.

Safe research

Use accounts and relays you control. Do not degrade the public service, access another person's data, send unsolicited traffic, or retain sensitive data. Stop when a vulnerability is established.

Response

The maintainer will acknowledge a usable private report, reproduce and assess it, coordinate a fix and disclosure where practical, and credit the reporter if requested. The founding beta does not yet promise a contractual response deadline or bounty.

Supported versions

The newest published release is supported. Older builds may be asked to update when a security or protocol fix cannot safely be backported.