This page is the document SECURITY.md of the project, rendered unchanged. If the page and the document differ, the document is right.

Security policy

easysync is pre-release software. It has not had an independent security audit, and no version has been released yet.

Reporting a vulnerability #

Please report suspected vulnerabilities by e-mail to security@easysync.me, in English or German.

Do not open a public issue or merge request for a vulnerability.
Describe what you found, the version or commit, and the steps to reproduce it. A proof of concept helps.
Do not send real pairing links, key material, clipboard contents or files of other people. Use test devices and test data.
If you want to encrypt your message, say so in a first e-mail and we will agree on a way.

We will credit you in the fix if you wish. We make no commitment about response times.

The engine and its wire protocol (protocol/): the pairing, the Noise handshakes, the record layer, the transfer protocol and resume.
The local state and key handling (the storage specification): the key store, state.db, the IPC endpoint and its access control.
The relay server (relay/syncengine-relay) and the relay protocol (protocol/).
The command-line client and daemon, the desktop and mobile apps and the web app in this repository, and the container images and release packages built from it.

Findings that need a device or an account that the attacker already controls (for example malware running as the same user, or a paired device that you chose to trust).
Traffic metadata that the specification states a relay can see (threat model).
Denial of service by a flood of traffic against a relay you do not operate.
Vulnerabilities in third-party services, operating systems or browsers that are not caused by how this repository uses them.
Social engineering, and physical attacks on an unlocked device.

The threat model and the security goals are in the architecture document of the specification.