Repository navigation
Security: no working private disclosure channel (security@ bounces, private reporting off) #2
Description
Hi maintainers. I tried to report a security issue privately and could not reach a working channel:
- The security contact in SECURITY.md and README (security@streamize.net) bounces with "Address not found."
- GitHub private vulnerability reporting is not enabled on this repo.
I have a write-up of a concern about the session_start auto-update path (unsigned code fetched and executed). Please provide a working security contact, create the security@ mailbox, or enable private vulnerability reporting.
(Note: I already emailed admin@streamize.net on 2026-07-01 at 12:50 CEST. This issue is a fallback because that address has not responded.)
Activity
nullarch commentedon Jul 8, 2026
Thank you for the careful, responsible disclosure — and apologies that the private channel didn't work; that's on us.
Auto-update (unsigned exec): fixed in #1. The updater now downloads the installer plus a detached Ed25519 signature, verifies it against a public key baked into the client, and executes only on a valid signature — fail-closed on a missing/invalid/placeholder key, with all three
curl | bash/iwr | iex/ python exec paths removed. It ships with auto-update off until a real signing key is provisioned, so there's no unsigned-exec window in the meantime. (RFC 8032 known-answer + tamper-rejection tests, a PyNaCl cross-check, and a real-Linux end-to-end are included; CI is green across macOS/Ubuntu/Windows.)Disclosure channel: we're fixing the
security@contact and enabling GitHub private vulnerability reporting so a report like yours reaches us properly next time. Sorry again for the bounce.Really appreciate you pushing us to close this the right way. 🙏