Security

If you believe you have found a security vulnerability in io2p, we want to hear about it. This page explains how to reach us, what we consider in scope, and what you can expect once you have reported something.

Project status

io2p is pre-1.0 and under active development. It has not yet been through an external security audit, and its APIs and storage formats can still change between releases. Run it behind your own authentication and network boundary, and do not assume it is hardened for production use.

We would rather say that plainly than imply a maturity the project has not reached yet.

How to report

Please do not open a public issue. A public report tells everyone — including whoever would exploit it — before there is a fix for anyone to upgrade to.

Two private channels, in order of preference:

• GitHub private vulnerability reporting. Open a draft advisory on the affected repository under github.com/maeconomy-org. This is the preferred route: it stays private, it gives us somewhere to develop and test the fix, and it handles CVE issuance and coordinated publication.
• Email info@maeconomy.org if you do not have a GitHub account or would rather use email. Please put security in the subject line.

Our machine-readable contact details are published at /.well-known/security.txt, per RFC 9116.

What to include

The more of this you can give us, the faster we can confirm and fix it:

• What the issue is, and what an attacker could achieve with it
• Steps to reproduce — ideally a minimal proof of concept
• The affected version, commit, or URL
• Any relevant configuration, logs, or requests, with secrets redacted

What to expect from us

• Acknowledgement within 3 business days that your report reached us.
• An initial assessment — whether we can reproduce it, and our view of the severity — within 10 business days.
• Progress updates as we work on a fix, and notice before we publish anything.
• Credit in the advisory, unless you would rather stay anonymous. Just tell us which you prefer.

We are a small team. If you have not heard back inside the acknowledgement window, please send a follow-up rather than assuming you were ignored — it far more likely means the report went astray.

Scope

In scope: the code in the io2p repositories — the storage node, the authentication service, the client library, the web applications, the infrastructure definitions — and this website.

Out of scope:

• Third-party dependencies. Report those to the upstream project. If a dependency issue is reachable through io2p in a way upstream would not consider a vulnerability, that part is in scope and we do want to hear about it.
• Any deployed instance we do not operate. io2p is self-hosted software; a particular deployment belongs to whoever runs it. Report it to them.
• Findings from automated scanners with no demonstrated impact, missing hardening headers with no exploit path, and reports that require an already-compromised host or physical access.

Safe harbour

We will not pursue or support legal action against anyone who reports a vulnerability in good faith and follows this policy. Specifically, if you:

• report privately through one of the channels above and give us reasonable time to respond,
• act only against your own instance or test data — not other people’s,
• do not access, modify, or destroy data that is not yours,
• do not degrade the availability of any service, and
• do not disclose publicly before we have had a chance to release a fix,

then we consider your research authorised, and we will say so if anyone asks.

If you are unsure whether something you want to test falls inside these lines, ask us first at info@maeconomy.org. We would much rather answer the question than have you not look.

Per-repository policies

Each io2p repository carries a SECURITY.md with the same policy and the same contact, plus the scope specific to that component. You can find them all under github.com/maeconomy-org.