Reporting a vulnerability

If you find a security problem in Tealhand, report it privately, not in a public issue.

How to report

1. Go to the repository, github.com/tealvpn/tealhand.
2. Open the Security tab and choose Report a vulnerability. This opens a private security advisory that only you and the maintainers can see.
3. Do not open a public issue or pull request about it, and do not post details elsewhere, until a fix is out.

There is no separate security email address.

What to include

• What the problem is and what an attacker could do with it.
• Which part it is in (for example tealhand-identity, tealhand-host, tealhand-relay) and the commit you tested.
• Steps to reproduce, or a small test. A failing unit test is ideal.
• Whether it needs anything special: a connected phone, the same local network, a relay you control, a given OS.

What counts

Anything that breaks one of the five safety rules is a serious bug. For example:

• a device that is not on the device list can open a control connection or run an action;
• a command runs without a valid signature from the phone, or runs twice;
• an action that needs a fingerprint or PIN runs without one;
• the planner’s answer, or text from a computer, leads to an action without the person’s tap on a card;
• the relay or the planner learns more than What leaves your devices says;
• a parser crashes, hangs or runs out of memory on hostile bytes.

Please do not

• Test against devices, relays or planners that are not yours.
• Put real keys, addresses or personal data in the report. Placeholders are enough.