<p>
<em>Last updated: November 7th, 2020</em>
</p>
<p>We greatly appreciate investigative work into security vulnerabilities carried out
by well-intentioned, ethical, security researchers.
We follow the practice of
responsible disclosure in order
to best protect our user base from the impact of security issues.
On our side, this
means:</p>
<ul>
<li>We will respond to security incidents as a priority.</li>
<li>We will fix the issue as soon as is practical, keeping in mind that not all risks are
created equal.</li>
<li>We will always transparently let our community know about any incidents that affect
them.</li>
</ul>
<p>If you have found a security vulnerability in t2bot.io, we ask thay you disclose it
reponsibly by messaging @travis:t2l.io on Matrix.
Please do not discuss potential vulnerabilities in public on near-public without first
validating with us.</p>
<p>On receipt, we will:</p>
<ul>
<li>Review the report, verify the vulnerability, and respond with confirmation or for
more information.
We typically reply within 24 hours.</li>
<li>Once the security bug has been addresses we will notify the reporter, who is then
welcome to optionally disclose publicly.</li>
</ul>
<p>Please note that although t2bot.io is built off Matrix, we cannot reasonably take the
lead on resolving incidents relating to the protocol.
If an issue is determined to be
an issue with the Matrix protocol, we will report it upstream to the Matrix team per
their security disclosure policy.
We
will respond to the original reporter to indicate that their report has been proxied
to the Matrix team, and, if desired, disclose the reporter to the Matrix team for
appropriate credit.
Similar programs apply for software t2bot.io depends on, such as
bridges and bots not authored by us directly.</p>
<p>We do not currently provide a bug bounty program.
We do, however, maintain a Hall of Fame
to recognize those who have responsibly disclosed security issues to us in the past.</p>
Hall of Fame
<ul>
<li>
<em>March 4th, 2021</em> - matrix-media-repo - jomat<br>
An issue where short audio files could crash the process.
Fixed in v1.2.3</li>
<li>
<em>April 15th, 2021</em> - matrix-media-repo - Muhammad Zaid Ghifari<br>
Memory exhaustion through thumbnailing crafted media.
Described as CVE-2021-29453
and fixed in v1.2.7.</li>
<li>
<em>April 30th, 2021</em> - matrix-media-repo - jomat<br>
An issue where malicious APNGs files could crash the process.
Fixed in v1.2.8</li>
</ul>
<p>If you think we missed you, sorry - please let us know by messaging
@travis:t2l.io on Matrix.</p>