Report a vulnerability

Found a flaw in Wesh? Write to us privately before publishing anything. Wesh is used when networks are down: a flaw can then hurt the people who depend on it.

Contact

Address

security@samourai.coop

The security.txt file carries the same information.

What to send us

• Platform and versions: app, operating system, phone model.
• Steps to reproduce the issue, and its impact.
• A proof of concept, if you have one.
• No data belonging to other people.

What we ask of you

• Test on your own devices, or with the explicit consent of the people involved.
• Do not disrupt real use of Wesh and do not read other people's messages.
• Give us time to fix the issue before publishing.

What we commit to

• Acknowledge your report and keep you informed of the fix.
• Agree on a publication date with you.
• Thank you publicly, if you wish.

Scope

In scope

• The Wesh app for iOS (wesh-bitchat-ios) and Android (wesh-bitchat-android), released versions and main branch.
• The protocol as implemented by Wesh: Bluetooth mesh, private message encryption, QR code verification, Internet mode over Tor.
• Encrypted storage on the phone and emergency erase.
• APK files distributed on this site.
• This website.

Out of scope

• The BitChat app and its repositories: report to the BitChat project, and tell us if Wesh is affected too.
• Third-party Nostr relays and the Tor network: report to their operators or to the Tor Project.
• Flaws in iOS and Android or their Bluetooth stacks.
• Radio jamming and denial of service by flooding Bluetooth.
• Documented limits: the local room is public, the phone is detectable over Bluetooth, public keys stay stable until reset, relays see metadata. Ideas to reduce them are welcome.