Please do not open a public issue for security vulnerabilities.

If you discover a security vulnerability in Zefer, please report it responsibly:

1. GitHub Security Advisory (preferred): Report a vulnerability
2. Email: m@carrillo.app
3. Telegram: @carrilloapps

• Description of the vulnerability
• Steps to reproduce
• Affected component (e.g., crypto.ts, zefer.ts, DecryptForm.tsx)
• Potential impact (data exposure, encryption bypass, etc.)
• Suggested fix (if applicable)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 7 days
• Fix release: As soon as possible, depending on severity

The following are in scope:

• Cryptographic weaknesses (AES-256-GCM, PBKDF2-SHA256 implementation)
• Key derivation flaws
• Authentication bypass (secret question, dual key, reveal key)
• Information leakage from the public header
• XSS, injection, or other OWASP Top 10 vulnerabilities
• Privacy violations (unintended data transmission)

The following are out of scope (by design, documented in docs/SECURITY.md):

• localStorage attempt tracking bypass (client-side friction, not a guarantee)
• Expiration bypass via system clock manipulation
• IP restriction bypass via JavaScript modification or VPN
• Browser memory inspection during active session

Zefer is a 100% client-side encryption tool. No plaintext, passphrases, or encryption keys ever leave the browser.

For the full threat model, see docs/SECURITY.md.

We appreciate responsible disclosure. Contributors who report valid vulnerabilities will be credited in the project (with permission).