Envoir is the reference implementation of DMTAP — sovereign, metadata-private messaging where your key is your identity. Security reports are taken seriously and handled with priority.

Please do not open a public issue for security problems.

• Preferred: GitHub private vulnerability reporting on vul-os/envoir.
• Alternatively, email vulosorg@gmail.com with [envoir security] in the subject.

You will get an acknowledgement within 72 hours and a status update at least every 14 days until resolution. Please allow a reasonable window to ship a fix before public disclosure.

• Identity & key handling — any path that leaks, mishandles or lets another party impersonate a keypair identity.
• Crypto — flaws in the MLS/X3DH/HPKE usage, sealed-sender, or the mesh/mixnet metadata-privacy guarantees.
• Transport-path provenance — claiming more anonymity than a tier provides.
• Legacy gateway — leaks across the DMTAP↔SMTP boundary (built and reported against the separate Ephor repo, not this one).

Out of scope: vulnerabilities requiring an already-compromised host, and issues in third-party services the operator configures.

Pre-1.0: only the latest release (and main) receives fixes.