The Garden of the Azazil team takes security vulnerabilities seriously — especially given that DaemonProc handles end-to-end encrypted P2P communication and cryptographic handshakes.

⚠️ Please do NOT report security vulnerabilities through public GitHub issues.

1. GitHub Private Vulnerability Reporting (Preferred): Go to Security Advisories and create a new private security advisory.

2. Email: Send a detailed report to security@gardenoftheazazil.dev.

• Description of the vulnerability
• Steps to reproduce or a proof-of-concept
• Impact assessment — what an attacker could achieve
• Affected component (e.g., handshake, NAT punch, IPC, encryption)
• Suggested fix (if any)

We use the CVSS v3.1 scoring system:

The following components are in scope for security reports:

• Cryptographic handshake implementation (Noise protocol)
• End-to-end encryption (key exchange, symmetric encryption)
• NAT traversal and UDP transport
• Unix socket IPC between applications and the daemon
• Authentication and peer identity verification
• Memory safety issues in Go code

The following are out of scope:

• Vulnerabilities in third-party dependencies (report upstream instead)
• Social engineering attacks
• Denial of service via network flooding (expected limitation of P2P)
• Issues in the libgota client library (separate project)

We believe in recognizing security researchers who help keep our users safe. With your permission, we will:

• Credit you in the security advisory
• Credit you in the CHANGELOG
• Add you to a SECURITY_HALL_OF_FAME.md (when applicable)

We follow coordinated disclosure:

1. Reporter submits the vulnerability privately
2. We confirm, assess, and develop a fix
3. We release the fix and publish a security advisory
4. Reporter is free to publish their findings after the advisory is public