Security disclosure
How to report security issues and product bugs, what is in scope, Safe Harbor expectations, and our public audit status.
Community (preferred): https://forum.buzzio.dev/
Open-source crypto: github.com/ve-21/buzzio-crypto-open-source · SECURITY.md
How to verify claims: How to verify
Independent audit status
No third-party security audit has been published yet for the Buzzio production app or the educational crypto reference package.
That is an honesty statement, not a claim that “security is finished.” Docs and the open crypto package describe mechanisms for review; they are not a substitute for a published formal audit. When an audit is published, we will link it here, on Cryptography overview, and on the product Security page.
Bug bounty: not offered yet. A paid program may come later; until then, thanks and coordinated disclosure via the Forum (and sensitive private email when needed) are the path.
How to report bugs and share ideas
Join our community on Buzzio Forum:
- Create an account and join the Buzzio communities there.
- Report bugs (security or product) in the appropriate category.
- Share ideas and feedback so we can improve the app together.
- Join our community program discussions — help test, review, and shape priorities.
For sensitive security findings (credential theft paths, remote code execution, crypto breaks with exploit detail), prefer a private Forum message/category if available, or email app449377@gmail.com with subject Security Report, and avoid posting a full public exploit before we can respond.
Never include (anywhere)
| Forbidden | Why |
|---|---|
| 12-word recovery phrase | Account takeover |
| Backup recovery keys | Unlocks encrypted history backups |
| Session tokens / private keys | Same class of risk |
| Live production secrets (CA keys, peppers) | Contact privately; do not paste in public threads |
Staff cannot “look up” your phrase. If you pasted it anywhere, treat that identity as compromised.
Scope
In scope (examples)
| Area | Examples |
|---|---|
| Sealed messaging crypto design / reference package | Breaks in X3DH, ratchet, sealed envelope, sender keys as documented / open-sourced |
| Client security | Auth bypass, unauthorized access to another user’s sealed content, serious local data exposure |
| Delivery / abuse controls | Issues that defeat blocks, spoof sealed delivery in a harmful way, or leak sealed content |
| Shared-mode boundaries | Cases where something labeled sealed behaves like shared (or the reverse) without disclosure |
| Docs honesty | Material misstatements we should correct on doc.buzzio.dev |
Out of scope (examples)
| Area | Notes |
|---|---|
| Social engineering of users | Phishing individuals |
| Denial of service against Firebase / CDN vendors | Report to the vendor where appropriate |
| Issues that require physical access + unlocked phone + malware already on device | Endpoint compromise is outside messenger crypto claims |
| “No Tor / no absolute anonymity” | Already an honest non-claim — see How to verify |
| Theoretical issues without impact | Prefer actionable repro steps |
| Spam / cosmetic UI nits filed as “security” | Use Forum product categories instead |
Shared rooms (Communities, Broadcast, open-history groups) intentionally store more — reporting that they are not sealed is not a vulnerability; reporting a mislabel is.
Safe Harbor
If you research and report in good faith:
- You make a good-faith effort to avoid privacy violations, data destruction, and service disruption.
- You do not exploit a vulnerability beyond what is needed to demonstrate it.
- You do not access or exfiltrate data that is not yours (stop when you confirm impact).
- You report promptly via Forum (or private email for sensitive cases) and give us a reasonable time to respond before public disclosure.
- You never publish recovery phrases, user private keys, or other users’ message content.
Under those conditions, Buzzio will not pursue legal action against you for the research methods that were necessary and proportionate to demonstrate the issue. We may still ask you to delete data you should not have retained.
Safe Harbor does not cover: ransomware, extortion, attacks on third-party users, physical break-ins, or continuing exploitation after we ask you to stop.
What is open vs closed
| Open (educational) | Closed (production) |
|---|---|
| Crypto reference algorithms & tests (repo) | Mobile app, Firebase wiring, Cloud Functions |
| Generic demo salts / demo CA material in the package | Real PBKDF2 salts, HKDF peppers, CA private key |
Security of messaging crypto must not depend on hiding algorithms (Kerckhoffs). Security does depend on keeping private keys, CA material, and production peppers secret.