Security policy

How to report

Write to security@setalk.app, in English or Portuguese.¹

• Please include: what you found, where (page, endpoint or app version), the steps to reproduce it, and what an attacker could do with it.
• Please don't report security problems in public channels before we've had a chance to fix them.
• PGP: a key for this address will be published later.¹

In scope

• The setalk.app website.
• SeTalk's account service (setalk.app/api/) and the payment page at pay.setalk.app.²
• The setup of SeTalk's servers for messages and files. The server software itself is unmodified SimpleX code, so a flaw in it goes to SimpleX (see below).³
• The SeTalk app for Android (package app.setalk), including the changes SeTalk makes to SimpleX.¹

Out of scope

• The original SimpleX project.A problem in the SimpleX code that SeTalk inherits unchanged should go to SimpleX, through its own security channel. If it also affects SeTalk, tell us too.⁴

• Attacks on other people's accounts or devices, social engineering of people, physical attacks, and denial-of-service tests.
• Reports that only say a page lacks a header or a best practice, with no way to exploit it.

What to expect

• First response: we aim to reply within 7 days of your report.
• We'll tell you whether we confirm the problem and keep you updated while we fix it.
• Please give us up to 90 days to fix the problem before you publish details. We'll agree on a date with you.
• If you want, we'll credit you by the name you choose once the fix is out.

Good faith

We won't take legal action against anyone who reports a vulnerability to us in good faith and follows this policy: who only accesses the data needed to show the problem, doesn't keep or share other people's data, and gives us time to fix it before going public.¹

This policy is listed in our /.well-known/security.txt, following RFC 9116.^1,5