Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting Vulnerabilities

Email security@cipherforge.dev. Do NOT open public issues for security bugs.

Acknowledgment within 48 hours
Assessment within 5 business days
Resolution within 10 business days

Scope

CipherForge cryptographic implementation flaws
Algorithm selection bypasses
Key handling vulnerabilities
Side-channel attack vectors

Out of Scope

Issues in third-party crypto libraries (report to upstream)
Social engineering

There aren't any published security advisories