Security
Reporting a vulnerability
If you think you have found a security problem in GHOSTFACE, please email us
before telling anyone else. A useful report includes:
- what you found and why it matters: what an attacker could do;
- the steps to reproduce it, and the app version, device and OS you used;
- any proof-of-concept, kept to the minimum needed to show the issue;
- whether, and how, you would like to be credited.
Please don't include anyone else's personal data in a report.
What's in scope
- The GHOSTFACE apps for iOS and Android
- Our API at api.ghostface.co.nz
- This website, ghostface.co.nz
- The cryptographic design: handshake, ratchet, call setup, invite cards
Out of scope: denial-of-service, spam or volume testing; social engineering
of our staff or users; physical attacks on devices; and services we don't run,
such as app stores, push-notification services and our SMS provider (report
those to them).
Please don't
- access, change or delete data that isn't yours. Use your own test accounts;
- disrupt the service for other people;
- keep any data you came across beyond what you need to report the issue.
What we commit to
- We'll acknowledge your report within three business days.
- We'll keep you updated while we work on it, and tell you when it's fixed.
- We'll credit you when we disclose it, if you'd like to be.
- We ask for 90 days to fix an issue before it's made public,
or less once a fix has shipped. We'll agree the timing with you.
We won't take legal action against research done in good faith that follows
this policy.
Rewards
We don't run a paid bug bounty yet. We do read every report, and we'll say so
here if that changes.
Independent review
An independent security review of the GHOSTFACE protocol and selected source
code by Cure53 is in progress. We'll publish the report, with its
findings and our fixes.