Security Policy

We take the security of DecoyPhrase seriously. Because our software handles sensitive cryptographic keys and private data, we appreciate the community's help in disclosing vulnerabilities responsibly.

1. Supported Versions

We only provide security updates for the latest stable release.

Project	Version	Supported
decoyphrase-web	1.x.x	✅
decoyphrase_mobile	1.x.x	✅
decoyphrase (Core)	1.x.x	✅
Older versions	< 1.0.0	❌

2. Reporting a Vulnerability

Do NOT open a public GitHub issue for security vulnerabilities.

If you discover a security vulnerability in any part of the DecoyPhrase ecosystem, please report it privately via email.

• Email: [email protected]

• Subject: [VULN] Short description

• Body: Please include:

  • Steps to reproduce.

  • Affected versions.

  • Proof of Concept (PoC) code or screenshots.

Response Timeline

1

Acknowledgment

We will acknowledge your report within 48 hours.

2

Assessment

We will provide an initial assessment and estimated fix timeline within 5 business days.

3

Fix & Disclosure

Once a fix is verified and deployed, we will coordinate a public disclosure.

3. Scope

We are interested in:

• Crypto flaws: Weak key generation, improper IV usage, or side-channel leaks in lib/crypto.

• Data leakage: Private keys being persisted insecurely (e.g., in localStorage without encryption, or sent to a server).

• Injection: XSS or other injection attacks in the Web client.

• Bypass: Methods to bypass biometric authentication on the Mobile app.

We are NOT interested in:

• UX bugs or typos.

• DDoS attacks on our documentation site.

• Issues related to third-party Arweave gateways (unless it compromises client security).

4. Safe Harbor

If you conduct security research within the scope of this policy, we consider your activities authorized and will not initiate legal action against you. We ask that you:

• Do not destroy or corrupt data.

• Do not interrupt or degrade our services.

• Give us reasonable time to fix the issue before making it public.