Please do NOT open a public GitHub issue for security vulnerabilities.

Preferred: Use GitHub's built-in Private Vulnerability Reporting to submit reports directly on GitHub.

Fallback: If GitHub private reporting is unavailable, email the maintainer at the address listed in the GitHub profile.

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Suggested fix (if any)

The following areas are in scope for security reports:

• E2EE implementation — Key generation, AES-256-GCM encryption/decryption, IV handling
• WebSocket protocol — Message injection, replay attacks, protocol downgrade
• Server relay logic — Information leakage, unauthorized room access, denial of service
• Authentication bypass — Room password bypass, share code prediction
• Client-side crypto — Key exposure, side-channel attacks, weak randomness

Out of scope:

• Social engineering attacks
• Denial of service via resource exhaustion (known limitation of free-tier hosting)
• Issues in third-party dependencies (report upstream)

We follow coordinated disclosure:

1. Reporter submits vulnerability privately
2. We acknowledge and assess
3. We develop and test a fix
4. We release the fix and publish a security advisory
5. Reporter receives credit in the advisory (unless anonymity is requested)

We believe in recognizing security researchers. Unless you request anonymity, you will be credited in:

• The GitHub Security Advisory
• The release notes for the fixing version
• The project's SECURITY.md acknowledgments section

No vulnerabilities reported yet. Be the first responsible disclosure!