Report privately through GitHub Security Advisories. Never open a public issue, discussion, or pull request for a suspected vulnerability.

If the advisory form is unavailable to you, email bakirgdev@gmail.com with SECURITY in the subject. The same two channels are listed at https://crocapp.dev/.well-known/security.txt.

Useful in a report:

• What an attacker gains, and what access they need to start.
• Steps to reproduce, ideally with the exact code phrase flow, relay, and platform.
• Version or commit, plus OS version and device.
• Whether the same behavior reproduces with the upstream croc CLI.

For now, CrocApp has a single maintainer, so there is no guaranteed response time and no bug bounty. The aim is to acknowledge a report within 7 days, as a best effort. Reports are read and answered as soon as reasonably possible. You will be told whether the issue is accepted, and credited in the advisory when it is fixed, unless you ask not to be.

Accepted issues get a GitHub Security Advisory, and a CVE is requested through it when the issue is eligible. Fixes are announced in the advisories for this repository, and the release that carries the fix names it in CHANGELOG.md and in its release notes.

Please hold public disclosure for 90 days from the report, or until a fix ships, whichever comes first. If the 90 days pass with no fix and no agreed extension, publish. Ask for an earlier date if a bug is being exploited and waiting is worse than telling people.

Good-faith research that follows this policy is welcome, and the maintainer will not pursue legal action over it. This covers only CrocApp's own code and your own devices and relay. It does not cover the public relay or other people's transfers: do not test against those.

In scope, meaning report it here:

Examples of what belongs here: a code phrase or transfer leaking into logs, a pasteboard, or a screenshot; sandbox or entitlement misuse; App Group data readable where it should not be; incorrect handling of a declined or cancelled transfer that still writes files; path traversal in received file names; a relay address or password persisted where it should not be.

Out of scope, meaning it belongs upstream in croc:

• The transfer protocol itself, PAKE, the session key derivation, and the relay design.
• Anything that reproduces identically with the croc CLI and no CrocApp involvement.

If you are unsure which side a bug lives on, report it here and it will be routed.

Also out of scope: reports generated by a scanner with no demonstrated impact, missing hardening that changes no attacker capability, and anything requiring a physically unlocked device that the attacker already controls.

Steps to check a release (notarization, build attestation, checksums, update signing) are in the verify downloads guide. An asset that fails any check, or one that appears anywhere other than this repository's releases page, is worth reporting.

Transfers are end-to-end encrypted, the code phrase authenticates both devices (PAKE), and the relay only ever sees ciphertext. CrocApp makes no stronger claim.

Supporting facts (no accounts, analytics, ads or tracking, history that stays on the device, your own relay, dependency scanning) are on the security and privacy page.