Add encrypted security reporting channels

2026-09-11 14:08:17 +10:00
1 changed files with 15 additions and 5 deletions
@@ -3,11 +3,21 @@
 ## Reporting a vulnerability

 Please do not open a public issue for an undisclosed vulnerability. Contact the
-snacforge maintainer in an end-to-end encrypted Matrix direct message at
-`@eric:sns.gdn`. Include affected versions, reproduction steps, impact, and any
-suggested mitigation. If Matrix is unavailable, open a minimal public issue
-asking the maintainer to establish a private reporting channel; do not include
-vulnerability details.
+snacforge maintainer using one of these private reporting channels:
+
+- End-to-end encrypted Matrix direct message: `@eric:sns.gdn`
+- OMEMO-encrypted XMPP message: `erici@xmpp.sns.gdn`
+- PGP-encrypted email: `erici@sdf.org`
+
+The PGP public key is available at
+https://erici.sdf.org/public-key.asc. Verify its fingerprint before use:
+
+`4E25 DCA8 A531 6763 A439 1BD2 4AE3 B4BF 07EB EB4F`
+
+Include affected versions, reproduction steps, impact, and any suggested
+mitigation. If none of the private channels are available, open a minimal
+public issue asking the maintainer to establish a private reporting channel;
+do not include vulnerability details.

 Receipt should be acknowledged within seven days. Status updates are normally
 provided at least every 14 days until resolution. Reporters are asked to allow