Security disclosure policy
OpenArcanum is built for people who need their conversations to stay private, so we take security reports seriously and thank everyone who sends one. This page says how to report an issue, what you can expect from us, and what we promise in return.
How to report
Use the security report form. Reports sent there are stored encrypted and read only by the maintainers. Please don't report vulnerabilities in public places (communities, issue trackers, social media) before they are fixed.
A good report includes:
- the component (desktop app, community server, relay, maintainer node, this website) and the version;
- what an attacker can do, to whom, and what they need first (a network position, membership in a community, a malicious server or relay…);
- steps to reproduce, or a proof of concept as text;
- your user ID and a community we can message you in, so we can ask questions. An e-mail address is optional.
Please send plain text only, and don't include other people's data, keys or messages.
What you can expect from us
- We confirm we've received your report within 3 working days.
- We tell you our assessment (whether we can reproduce it, and how severe we think it is) within 10 working days.
- We keep you updated while we work on a fix and tell you before we publish it.
- We aim to fix issues and publish an advisory within 90 days, sooner for severe ones. If we need longer, we'll explain why and agree a date with you.
- With your permission, we credit you by the name you choose in the advisory.
Safe harbour
We will not pursue or support legal action against you for security research done in good faith under this policy. Good faith means that you:
- test only against your own accounts, communities, servers and data, or with the explicit permission of their owners;
- don't access, change, keep or share other people's data beyond the minimum needed to show the issue, and stop and tell us at once if you come across any;
- don't degrade the service for others (no denial-of-service testing, spam or social engineering of users or maintainers);
- give us a reasonable time to fix the issue before you disclose it, as above.
If in doubt whether something is in scope, ask us first through the form. If someone else brings legal action against you for research that followed this policy, we will make it known that you acted with our authorisation.
Scope
In scope: the OpenArcanum desktop app, the community server, relay and maintainer node software, and this website. Out of scope: issues that need a compromised device of the victim, reports from automated scanners without a demonstrated impact, and missing best practices without a concrete attack.