Reporting a security problem
You are invited to look for problems in Yeetline and to tell us about them. This is a standing invitation, not a program with a deadline: if you are a researcher, a student, a customer's security team or someone who just noticed something odd, we want to hear it.
How to reach us
A Yeetline server publishes where to send a report at /.well-known/security.txt (the standard way, RFC 9116) once its operator has set a contact; a server with none answers "not found" there, and then the operator is the person to ask. The contact in the file is the one to use. Please do not open a public issue for something that is not yet fixed.
Say what you did, what you expected, what happened, and, if you have one, a proof of concept. We will answer within seven days. There is no bounty. Credit in the release notes is yours if you want it, and not if you do not.
What is in scope
- The cryptography: the message handshake and ratchets, sealed blocks, the keystore, the hand-off between pages, the recovery key, and how a release is signed and checked.
- The web app, the admin pages, the phone and desktop apps, and the server that relays messages.
- Anything that lets someone read what they should not, write as someone else, get past a second factor, run code in another person's page, or take over an account.
- A sentence in the documents or in the app that says Yeetline protects something it does not. That counts. Those have been found, and corrected.
What is out of scope
- Attacks that need your device, your unlocked screen or your passphrase.
- Metadata the documents already say the server can see.
- Denial of service by sending a very large amount of traffic.
- Social engineering of people who work on or use Yeetline.
- Findings that a third-party library has already published and fixed upstream, unless Yeetline uses it in a way that makes it worse.
- Anything on a server you do not run or have not been invited to test.
Please do
- Test with accounts of your own, on a server you run or whose operator has agreed.
- Stop and tell us as soon as you reach something that is not yours: another person's messages, keys or data.
- Give us reasonable time to fix a problem before you publish it. We will say what the time is when we answer.
What we promise
We will read it, answer it, tell you what we decide, and fix what is wrong. If you act in good faith, stay inside this page, and do not read, change or keep other people's data beyond what is needed to show the problem, we will not take or support legal action against you for it, and we will say so to anyone who asks.
What we cannot promise
We are a small project. A fix may take longer than we would like, and we will say so when it does. There is no bounty, and we cannot speak for the operator of a server we do not run: if you find a problem in someone else's deployment, tell them as well.
Where this fits
Who we defend against says what the project already knows it does not protect. Our own security review lists what has been found so far.
Last changed 2026-10-19