Skip to content

SECURITY.md

Latest commit

 

History

History
80 lines (52 loc) · 3.92 KB

SECURITY.md

File metadata and controls

80 lines (52 loc) · 3.92 KB
Raw

Security Policy

This security policy applies to software and services maintained by Synonym (including Synonym Software and related open-source projects under Synonym / Pubky organizations), such as:

  • Bitkit and related wallet / Lightning components
  • Pubky stack (e.g. Pubky App, Pubky Core / Homeserver, Pubky Ring, Pubky Nexus, and related clients)
  • Other Synonym-published repositories that link to this policy

If a repository has its own SECURITY.md, that file takes precedence for that repository.

What counts as a security vulnerability

Please treat an issue as a security vulnerability if it could reasonably lead to:

  • Loss of funds (theft, unauthorized spend, unsafe key/seed handling, broken signing flows)
  • Compromise of keys, seeds, credentials, or session material
  • Unauthorized access to accounts, Homeserver data, or private user data
  • Loss of privacy beyond normal public /pub/ data (e.g. leaking private keys, auth tokens, or non-public content)
  • Remote code execution, privilege escalation, or memory corruption in Synonym software
  • Authentication / authorization bypass (including Pubky Ring / pubkyauth flows)
  • Critical integrity failures that could cause users to accept false data as authentic in a security-sensitive context

If you are unsure, report it privately anyway. We would rather triage a non-issue than miss a real one.

Out of scope (usually)

Please use the public issue tracker (or normal support channels) for:

  • Feature requests and general bugs with no security impact
  • Social engineering / phishing against users (unless you found a Synonym product defect that enables it)
  • Denial of service that requires unrealistic resources, unless it is trivially triggered and clearly impactful
  • Issues in third-party dependencies already fixed upstream (feel free to flag them; we may still want a heads-up)
  • Security problems only present in unofficial forks, modified builds, or unsupported versions

Supported versions

We aim to address security issues in:

  • The latest stable release of each actively maintained product
  • Other versions explicitly listed as supported on the product’s release / lifecycle notes

Older or end-of-life versions may not receive patches. When in doubt, update to the latest release before reporting “still vulnerable on my build” follow-ups.

Reporting a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Please report privately to:

Include as much as you can:

  • Affected product / repository / version (commit hash or release tag if possible)
  • Description of the issue and security impact
  • Steps to reproduce (PoC welcome; keep it minimal and non-destructive)
  • Any suggested fix (optional)
  • Your preferred contact and whether you want public credit

If you can, encrypt sensitive details with OpenPGP. Fingerprints / public keys for Synonym security contacts will be listed here when published:

Contact Role OpenPGP fingerprint
Synonym Security Security reports TBD – add key fingerprint

Our process

  • We acknowledge receipt (target: within a few business days).
  • We triage severity and confirm the issue.
  • We work on a fix and, where needed, coordinate disclosure.
  • We may ask for more details or a quiet period while users can update.
  • After a fix is available (or we close the report), we can discuss credit and public write-up.

We ask reporters not to disclose publicly until we have confirmed a fix is available, or we have agreed on a disclosure date, except where legally required or where users face immediate active exploitation (in which case contact us ASAP).

Report via security@synonym.to as described above.

Prefer private report over public “gotcha”

Synonym products often touch keys, funds, and identity. Responsible disclosure protects users. Thank you for helping to keep the ecosystem safer.