IMPORTANT: This package implements the Signal Protocol for end-to-end encryption. Security vulnerabilities must be handled with utmost priority.

1. DO NOT file a public GitHub issue for security vulnerabilities.

2. Send an email to security@kelvdra.dev with:

   • Subject: [SECURITY] libsignal - Brief description
   • Detailed description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

3. You will receive an acknowledgment within 48 hours.

4. We will work on a fix and coordinate a release timeline.

5. Once the fix is released, we will credit you in the release notes (unless you prefer to remain anonymous).

• Cryptographic weaknesses in the Signal Protocol implementation
• Side-channel attacks
• Timing attacks
• Key leakage through logging or error messages
• Session corruption or manipulation
• Authentication bypass
• Dependency vulnerabilities

This policy covers:

• The @akaanakbaik/libsignal npm package
• The source code in this repository
• Build and release pipelines

• The official Signal Protocol specification (report to Signal Foundation)
• Downstream projects using this package (report to respective maintainers)

• No console.log/info/warn/debug/error in production code paths that could leak sensitive data
• Constant-time comparisons for MAC verification
• Cryptographic boundary checks on all key material
• Input validation on all public API parameters

• Automated npm audit runs nightly via GitHub Actions
• Dependency review on all PRs
• Dependabot configured for weekly updates
• All dependencies are pinned to minor versions

• Package is published with --access public
• All releases are git-tagged and signed
• npm 2FA is required for publishing
• CI/CD pipeline enforces test pass before release

This package implements the Signal Protocol. Key security properties:

• Private keys are NEVER logged under any circumstances
• Session data is NEVER logged under any circumstances
• Ephemeral keys are NEVER logged under any circumstances
• Root keys are NEVER logged under any circumstances
• Registration IDs are NEVER logged under any circumstances

If you encounter any log output containing sensitive data, please report it immediately.