Reporting a security problem

If you have found a security problem in Gryt, email [email protected]. That address is also in our security.txt.

Please do not open a public issue for it. A public issue is a working exploit handed to everybody running a Gryt server, days or weeks before any of them can update.

What we would like in the report

Enough to reproduce it: what you did, what happened, what you expected, and which version or address you were on. A rough note we can follow is more use than a tidy one missing the step that matters.

If you are not sure whether something counts, send it anyway. Deciding is our job, and a report that turns out to be nothing costs us a few minutes.

What is in scope

• The Gryt clients — desktop, web and mobile — and the server, the SFU and the other services in our repositories.
• The services we run: gryt.chat, app.gryt.chat, auth.gryt.chat, id.gryt.chat and community.gryt.chat.

What is not

• Gryt servers other people run. Anyone can host one, and we have no access to it and no authority over it. Report it to whoever runs it.
• Anything needing physical access to somebody’s unlocked machine. If an attacker is already there, they have already won.
• Reports from a scanner with nothing behind them. A list of missing headers with no described impact is not a finding. Tell us what somebody could do with it.
• Denial of service by volume. Any service can be knocked over with enough traffic. Please do not demonstrate it on ours.

What we can promise, and what we cannot

Gryt is maintained by one person. We will read your report and reply, but we are not going to name a number of hours and then miss it. Something being actively exploited, or exposing other people’s messages, goes ahead of everything else we are doing.

There is no bug bounty. We have no money for one, and saying otherwise would waste your time. What we can offer is credit in the release notes and in the commit, if you want it, and a straight answer about what we are doing and when.

While you are looking

Test against a server you run. Standing one up takes a few minutes and is documented at self-hosting, and it means you can be as rough as you like without touching anybody else’s conversations.

If you do find something on a service we run, stop at the point where you have proved it. Please do not read, change or keep other people’s data, and do not degrade the service for the people using it. Report it and we will take it from there.

If you stay inside that, we will not pursue you for it, and we will say so plainly if anybody asks.

What happens after

We fix it, release it, and say what it was. Gryt is open source, so the fix is public the moment it lands and the commit explains itself — which is also why we would rather tell people plainly than let them work it out from a diff.