[{"data":1,"prerenderedAt":34},["ShallowReactive",2],{"$f2imi4c56nt3ye":3},{"intro":4,"sections":5},"\u003Cp>If you found a security problem in QxChat, thank you. This page explains how to tell us, what we will do with your report, and what we ask in return. It follows the same rules as most open-source projects and matches our \u003Ca href=\"\u002F.well-known\u002Fsecurity.txt\">security.txt\u003C\u002Fa>.\u003C\u002Fp>\n",[6,10,14,18,22,26,30],{"id":7,"title":8,"html":9},"report-a-vulnerability","Report a vulnerability","\u003Cp>Write to \u003Cstrong>\u003Ca href=\"mailto:contact@qxch.at\">contact@qxch.at\u003C\u002Fa>\u003C\u002Fstrong> with "Security" in the subject. English or French are both fine.\u003C\u002Fp>\n\u003Cp>Please do not open a public GitHub issue, post on Discord or publish anything about the problem before it is fixed. A public report puts every user at risk until a fix ships.\u003C\u002Fp>\n\u003Cp>A useful report includes:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>what is affected: the server (\u003Ccode>lqxp\u002Flqxp\u003C\u002Fcode>), an app (Android, iOS, desktop, web), this website, or the public instance \u003Ccode>qxch.at\u003C\u002Fcode>;\u003C\u002Fli>\n\u003Cli>the version or commit you tested;\u003C\u002Fli>\n\u003Cli>the steps to reproduce, or a proof of concept;\u003C\u002Fli>\n\u003Cli>what an attacker could do with it, as far as you can tell;\u003C\u002Fli>\n\u003Cli>how you would like to be credited, if at all.\u003C\u002Fli>\n\u003C\u002Ful>\n",{"id":11,"title":12,"html":13},"what-happens-next","What happens next","\u003Cul>\n\u003Cli>We confirm we received your report, usually within a few days.\u003C\u002Fli>\n\u003Cli>We check it, reproduce it and tell you whether we consider it a vulnerability.\u003C\u002Fli>\n\u003Cli>We work on a fix and keep you informed of the progress.\u003C\u002Fli>\n\u003Cli>Once the fix is released, we publish a note describing the problem and credit you, unless you prefer to stay anonymous.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>QxChat is made by volunteers. We do our best to answer quickly, but we cannot promise fixed delays. We ask you to give us a reasonable time to fix the problem before you disclose it, normally up to 90 days from your report. If a fix needs longer, we will tell you why and agree on a date with you.\u003C\u002Fp>\n",{"id":15,"title":16,"html":17},"in-scope","In scope","\u003Cul>\n\u003Cli>The LQXP server: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Flqxp\" target=\"_blank\" rel=\"noopener\">github.com\u002Flqxp\u002Flqxp\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>The QxChat apps and web client: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Fapp\" target=\"_blank\" rel=\"noopener\">github.com\u002Flqxp\u002Fapp\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>The public instance at \u003Ccode>qxch.at\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>This website: \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Fsite\" target=\"_blank\" rel=\"noopener\">github.com\u002Flqxp\u002Fsite\u003C\u002Fa>.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Examples of what interests us most: reading or changing messages you should not have access to, taking over an account, getting around rate limits or the proof-of-time challenge at scale, leaking data the \u003Ca href=\"\u002Fprivacy\">privacy policy\u003C\u002Fa> says we never store, and anything that runs code on a server or a device.\u003C\u002Fp>\n",{"id":19,"title":20,"html":21},"out-of-scope","Out of scope","\u003Cul>\n\u003Cli>Attacks that need physical access to an unlocked device, or a device already compromised by malware.\u003C\u002Fli>\n\u003Cli>Denial of service by sheer volume of traffic, and load testing against \u003Ccode>qxch.at\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>Social engineering, phishing, or attacks on the people running the project.\u003C\u002Fli>\n\u003Cli>Reports from automated scanners with no demonstrated impact.\u003C\u002Fli>\n\u003Cli>Missing security headers or best practices with no practical attack.\u003C\u002Fli>\n\u003Cli>Servers run by other people. Report those to their operator.\u003C\u002Fli>\n\u003Cli>Known limitations we already document, listed in \u003Ca href=\"\u002Fwiki\u002Fprotocol-changes\">Changelog and gaps\u003C\u002Fa>.\u003C\u002Fli>\n\u003C\u002Ful>\n",{"id":23,"title":24,"html":25},"safe-harbour","Safe harbour","\u003Cp>We will not take legal action against you, and will not ask anyone to, for research that respects these rules:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>you only use accounts you own, or accounts whose owners agreed to it;\u003C\u002Fli>\n\u003Cli>you do not access, keep or share other people's data beyond the minimum needed to show the problem, and you delete it afterwards;\u003C\u002Fli>\n\u003Cli>you do not degrade the service for other users;\u003C\u002Fli>\n\u003Cli>you give us reasonable time to fix the problem before telling anyone else.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>If in doubt, write to us before you test. Research done in good faith that accidentally goes a little beyond these rules will be treated as such.\u003C\u002Fp>\n",{"id":27,"title":28,"html":29},"rewards","Rewards","\u003Cp>QxChat has no budget for a paid bug bounty. What we can offer is our thanks, public credit in the release notes and in the advisory, and a mention on the project's Discord or Github if you want one.\u003C\u002Fp>\n",{"id":31,"title":32,"html":33},"run-your-own-tests","Run your own tests","\u003Cp>The fastest way to test without any risk to other users is to run your own server. It takes one Rust program and one configuration file: see \u003Ca href=\"\u002Fwiki\u002Fself-hosting\">Run your own server\u003C\u002Fa>. The \u003Ca href=\"\u002Fwiki\">handbook\u003C\u002Fa> describes every protocol and every cryptographic choice in detail, including the \u003Ca href=\"\u002Fwiki\u002Fcrypto-primitives\">primitives\u003C\u002Fa> and the \u003Ca href=\"\u002Fwiki\u002Fanti-abuse\">anti-abuse\u003C\u002Fa> system.\u003C\u002Fp>\n",1793535120531]