We take the security of CHRONODESK seriously. If you believe you have found a security vulnerability, please report it to us as follows:

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via the GitHub Security Advisory:

🔒 Report a vulnerability

• Type of vulnerability
• Full reproduction steps
• Affected versions
• Potential impact
• Any suggested fixes (if known)

• Acknowledgment within 48 hours
• Initial assessment within 5 business days
• Regular updates on progress (every 7 days minimum)
• Coordinated disclosure — we will work with you on timing

We follow a 90-day disclosure window. After a fix is released, we will publish a security advisory detailing the issue.

At this time we do not offer a paid bug bounty program. We will publicly acknowledge your contribution in our security hall of fame (with your permission).

CHRONODESK uses ChaCha20-Poly1305 (AEAD) via the ring crate for encrypting data channel messages. Key exchange uses ECDH (X25519) with ephemeral keys per session, negotiated at connection start via a handshake message. The shared secret is derived through HKDF-SHA256 into a 32-byte session key. All subsequent messages are encrypted transparently. Legacy unencrypted messages are also accepted for backward compatibility.