SonicChat is experimental alpha software. It has not received an independent security audit and must not be treated as an emergency or safety-critical communication system.

Security fixes currently target the latest commit on main. No released build has a long-term support promise yet.

Use Security → Report a vulnerability on the GitHub repository. This opens a private report visible to maintainers. Please do not create a public issue for a suspected vulnerability and do not include real private messages, keys, or unredacted device identifiers.

Include, when possible:

• the affected commit and platform;
• impact and required attacker position;
• minimal reproduction steps or a test case;
• whether the issue crosses an acoustic, local-storage, or UI trust boundary; and
• a safe way to contact you for follow-up.

You should receive an acknowledgement within seven days. Timelines for validation, repair, and disclosure depend on severity and maintainer capacity; the project will coordinate before public disclosure when the report is valid.

Read docs/SECURITY.md for implemented controls and docs/THREAT_MODEL.md for residual risks. In particular:

• audible sound can be recorded, blocked, collided, and traffic-analysed;
• only encrypted mode provides content confidentiality;
• a matching SAS must be compared on both devices to resist pairing MITM;
• compromised endpoints and malicious current group members can reveal content; and
• the native daemon's explicitly accepted key-file mode is weaker than an OS key store.