Security policy
Reporting a vulnerability
Please report security problems privately, not in a public issue.
- Email security@zyaku.com, or
- use GitHub's private vulnerability reporting on this repository (Security tab, "Report a vulnerability").
Include what you found, how to reproduce it, and what an attacker could do with it. We aim to acknowledge reports within three working days and to agree a disclosure date with you. We credit reporters who want to be credited.
What counts
Anything that could make HoldSend:
- send an item twice, or never send it, when the documented contract was followed;
- send one person's item as another person;
- reveal an item's content, key or written time to someone who should not see it;
- let a client backdate or reorder published content through the written time.
Supported versions
The first release is 0.1.0. Until 1.0, only the latest release receives fixes.