Trust
Security and disclosure
BitGab is proprietary and closed source. Reports about the Android client, the Cloudflare backend, the wake path, and the distribution chain are welcome. There is no bug bounty.
- What you found, and where: build flavour and version, endpoint, screen, or component.
- How to reproduce it, including the device or Android version if it is device-specific.
- The impact you believe it has, and what an attacker would gain.
- Whether you want to be credited, and the name or handle to use.
- Any proof-of-concept material, kept minimal and free of other people's data.
A clear reproduction is more useful than a long report. If you are unsure whether something is in scope, send it and ask.
Commitments
What BitGab will do
- Read the report and tell you whether we consider it in scope, and why.
- Try to reproduce it and tell you what we found.
- Fix it, or document a mitigation and its residual risk.
- Coordinate public disclosure after a fix ships.
- Credit you unless you ask us not to.
BitGab does not promise response times. The project is small and operates without a 24/7 security team. A report is still read.
Boundaries
What BitGab will not do
- No bug bounty. BitGab does not pay for vulnerability reports.
- No third-party audit. BitGab does not commission third-party code reviews, and there is no SOC 2 report or ISO 27001 certificate.
- No source publication. The repository is private, and source is not provided to a customer's auditor.
- No threat against good-faith research. BitGab will not pursue a researcher who follows this policy.
- No response-time promise. Do not plan a disclosure deadline around an unstated service level.
Scope
In scope and out of scope
In scope
- The Android client, both libre and gms: cryptography, key handling, local storage, intents, and permissions.
- The Cloudflare backend: authentication, authorisation, Durable Objects, D1 and R2 access control, and rate limiting.
- The wake-push path: the opaque blob and the distributor integration.
- The distribution chain: build reproducibility, signing, and the update path.
Out of scope
- A rooted device with an unlocked bootloader, or physical extraction with the device unlocked.
- Denial of service by volume.
- Social engineering of BitGab staff.
- Third-party services such as Cloudflare, Google, or a UnifiedPush distributor. Report those to the provider.
- Theoretical weakness without a demonstrated impact.
Researchers
For researchers
The security contact and safe-harbour terms are published here and in security.txt.
BitGab will not pursue legal action against a researcher who:
- acts in good faith and within this policy;
- does not access, modify, or exfiltrate data that is not theirs;
- does not degrade service for others;
- reports promptly and does not publicly disclose before a fix ships.
Credit is offered unless you ask not to be named. There is no payment. If you need a formal acknowledgement for your own records, say so in the report.
The canonical security contact is security@bitgab.app. The policy URL in security.txt is https://bitgab.app/security, and this section is its #researchers anchor.
Questions
Security questions
Do you pay for vulnerabilities?
No. There is no bug bounty and no payment for reports. Credit is offered unless you decline it.
Can I see the source?
No. BitGab is proprietary and closed source. The repository is private and source is not provided to a customer's auditor. A customer may commission an assessment of its own deployment at its own expense.
Do you have SOC 2 or ISO 27001?
No. There is no SOC 2 report, no ISO 27001 certificate, and no third-party audit. BitGab does not claim otherwise.
Can I test against your production service?
Do not run a test that degrades service, touches other people's data, or requires volume. Send the plan to security@bitgab.app first if you are unsure.