Reporting a vulnerability

TrueSeal is a developer preview. Security reports are handled best effort, with no SLA and no bug bounty.

How to report

Report a vulnerability through GitHub private vulnerability reporting. Open the Security tab of the repository the flaw is in and choose Report a vulnerability. Never report a vulnerability in a public issue, pull request or discussion.

• trueseal-sync
• trueseal-noise
• trueseal-relay
• trueseal-sync-swift
• trueseal-sync-kotlin
• trueseal-sync-ts
• trueseal-docs

Fixes and advisories

Fixes, security fixes included, land only in the next 0.x release. Nothing is backported to an older 0.x release. Advisories are published through GitHub Security Advisories.

What TrueSeal does and doesn’t claim is on the Threat Model.

The Agent Docs version is at /agents/reporting-a-vulnerability.