Security

Reporting a vulnerability

Write to security@osvoid.se. We answer within 7 days.

Good-faith research is welcome, including reverse engineering our apps, and we will not pursue it. Good faith means you do not access other people's data or disrupt our servers, and you give us time to fix a problem before you publish it.

Release keys

Both apps carry two Ed25519 public keys and install only updates signed with one of them. The signed update index holds the SHA-256 of the release archive, and the signed release manifest the SHA-256 of every file; the app checks the signature, then every hash.

• online, signs every release: 8ce9ae7b6b2084748ecd29b38f651a92ab4f1185b6c6367e1f80441e4782f69e
• backup, kept off our servers and GitHub, to replace the online key if it leaks: d00fe2ef531670d2b6bc2aacd576ae894484b8b30a4467b57da4e36defb115b4

The setup files on Download are not signed with these keys. Each installs itself as the launcher, which installs only releases signed with one of them.