At Concealment, we take security seriously. If you discover a security vulnerability, please report it responsibly rather than disclosing it publicly. Your help in protecting our users is deeply appreciated.

We're interested in reports of:

• Cryptographic weaknesses (e.g., flawed key generation, improper encryption implementation)
• Authentication bypasses (e.g., ways to access accounts without credentials)
• Private key exposure (e.g., plaintext key storage, insecure passphrases)
• Data leaks (e.g., plaintext messages stored on servers)
• Zero-day vulnerabilities in dependencies (OpenPGP.js, Firebase, etc.)
• Timing attacks or other side-channel attacks on crypto operations
• XSS/Injection vulnerabilities in the web client
• Denial of Service vectors that compromise service availability
• Privilege escalation bugs (e.g., accessing other users' encrypted data)
• Compliance issues (e.g., violations of GDPR, privacy frameworks)

We appreciate your help, but the following are not security issues:

• General UI/UX improvements or feature requests
• Performance optimizations without security implications
• Missing security headers (we handle these separately)
• Third-party service misconfiguration (Firebase, Railway, etc.)
• Social engineering or phishing attacks
• Reports about competitors' security practices
• Vulnerabilities in your own systems or dependencies you control

Please report all security vulnerabilities using this form:

🔗 Concealment Security Report Form

The form captures:

• Your contact information (name, email)
• Vulnerability description
• Steps to reproduce (if applicable)
• Proof of concept (if available)
• Impact assessment
• Suggested fixes (optional)

1. Acknowledgment (within 24-48 hours)

   • We'll confirm receipt of your report
   • Assign a reference number for tracking
   • Ask clarifying questions if needed

2. Investigation (1-2 weeks)

   • Our security team investigates the issue
   • We verify the vulnerability in our code
   • We assess the severity and impact

3. Fix Development (severity-dependent)

   • Critical (CVSS 9-10): Fix within 7 days
   • High (CVSS 7-8): Fix within 14 days
   • Medium (CVSS 4-6): Fix within 30 days
   • Low (CVSS 1-3): Fix within 60 days

4. Notification (before public disclosure)

   • We'll notify you when the fix is deployed
   • You'll receive security advisory details
   • We'll credit you in our security advisories (if desired)

5. Public Disclosure

   • We publish a security advisory on GitHub
   • We update our dependencies
   • We document lessons learned

We use CVSS v3.1 to assess vulnerability severity:

• Primary Contact: security@concealment.live
• Reporting Form: Concealment Security Report
• GitHub Security Advisory: https://github.com/dibyx/concealment-docs/security/advisories
• Response Time SLA: 24-48 hours for acknowledgment

Note: We monitor the Google Form actively. If you don't hear back within 48 hours, please send an email to security@concealment.live as a backup.

When reporting a vulnerability, please:

✅ DO:

• Report vulnerabilities directly via the secure form or email
• Be clear and detailed in your description
• Provide proof-of-concept code if possible
• Give us time to fix before public disclosure (at least 90 days)
• Encrypt sensitive communications with our PGP key (see below)
• Test in a staging environment, not production

❌ DON'T:

• Publicly disclose the vulnerability on social media, forums, or issue trackers
• Access other users' encrypted data
• Modify, delete, or exfiltrate data from our systems
• Launch denial-of-service attacks
• Demand payment or publicity (we credit you voluntarily)
• Report via unencrypted channels for highly sensitive issues

For highly sensitive vulnerability reports, you may encrypt your submission using our PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

[Your PGP key block here]

-----END PGP PUBLIC KEY BLOCK-----

Key ID: ABCD 1234 5678 90EF GHIJ
Fingerprint: ABCD 1234 5678 90EF GHIJ KLMN OPQR STUV WXYZ

Concealment is a non-commercial, community-driven security project. While we don't currently offer financial bounties, we:

• Credit you publicly in our security advisories (if desired)
• Feature you on our website as a security contributor
• Provide early access to features and beta releases
• Collaborate on deeper security research

If you've found a critical vulnerability and would like to discuss a bounty, please contact security@concealment.live directly.

While we work hard to keep Concealment secure, users should also:

• ✅ Use strong, unique passphrases (12+ characters, mixed case, numbers, symbols)
• ✅ Never share your passphrase or private key with anyone
• ✅ Write down your passphrase in a safe place (we can't recover it)
• ✅ Rotate keys periodically if you suspect compromise

• ✅ Keep your device OS and browser updated
• ✅ Use device-level encryption (BitLocker, FileVault, LUKS)
• ✅ Enable biometric locks or strong PINs
• ✅ Be cautious of malware and keyloggers

• ✅ Verify fingerprints out-of-band before trusting new contacts
• ✅ Use self-destruct timers for sensitive conversations
• ✅ Don't reuse passphrases from other services
• ✅ Assume your device may be compromised and act accordingly

• ✅ Concealment prevents content interception and server compromise
• ⚠️ Concealment does NOT prevent device compromise or metadata leaks
• ⚠️ Timestamps and participant IDs are still visible in Firestore
• ⚠️ A malicious recipient can still read messages they decrypt

We follow these practices to keep Concealment secure:

• Dependency scanning for vulnerable packages (npm audit, GitHub Dependabot)
• Code review of all pull requests by security-trained developers
• Static analysis (linting, type checking) on every commit
• Security testing before major releases

• Monthly: Update dependencies and patch packages
• Quarterly: Security audit of critical components
• Annually: Third-party penetration testing (planned Phase 2+)
• As-needed: Emergency patches for critical vulnerabilities

• We support the latest stable release and the previous major version
• Security patches are released for the current and previous versions
• Older versions should be upgraded immediately
• End-of-life announcements are made 90 days in advance

• ✅ Cryptographic operations – Key generation, encryption, decryption, signing
• ✅ Authentication flows – Signup, login, session management
• ✅ Access control – Users can only see their own conversations
• ✅ Data encryption – Messages stored as ciphertext, never plaintext
• ✅ Input validation – XSS, injection, and buffer overflow prevention
• ✅ Dependency security – Vulnerable packages and known exploits

Users can verify Concealment's security:

1. Inspect network traffic – Use browser dev tools to see encrypted payloads
2. Review source code – All client-side crypto is visible in browser DevTools
3. Check Firestore rules – Review security rules in Firebase Console
4. Audit dependencies – Run npm audit or flutter pub outdated
5. Test encryption – Generate a key, encrypt a message, verify ciphertext

For deeper security details, see:

• README.md – Technical architecture
• Privacy Policy – Data handling & encryption
• User Manual – Security features & best practices
• Threat Model (below) – Detailed threat analysis

Concealment Protects Against:

• ✅ Server compromise – Attacker reads Firestore; still sees only ciphertext
• ✅ Man-in-the-middle – Attacker intercepts messages; encrypted with PGP
• ✅ Passive surveillance – Network observer sees only encrypted blobs
• ✅ Malicious admins – Admins cannot decrypt messages without private keys
• ✅ Future compromise – RSA-4096 keys remain secure for 20+ years

Concealment Does NOT Protect Against:

• ❌ Device compromise – Malware on your device can read plaintext
• ❌ Metadata leaks – Timestamps and participant IDs are visible
• ❌ Malicious recipient – They can read messages they decrypt
• ❌ Quantum computers – Future quantum attacks on RSA (Phase 3 will add post-quantum)
• ❌ Social engineering – Tricking you into sharing your passphrase

• Phase 2: Post-quantum cryptography (Kyber, Dilithium)
• Phase 2: Third-party security audit
• Phase 3: Hardware security module (HSM) support
• Phase 3: Decentralized infrastructure options
• Phase 3: Zero-knowledge proofs for metadata privacy

If you have questions about this policy, security practices, or vulnerability reporting:

📧 Email: security@concealment.live
🔗 Form: Concealment Security Report
💬 GitHub Discussions: https://github.com/dibyx/concealment-docs/discussions

We deeply appreciate the security community's support in keeping Concealment safe. Your responsible disclosure helps us protect millions of users' privacy and security.

Together, we're building encryption that works. 🔐

Last Updated: December 24, 2025
Status: Active
Next Review: June 24, 2026