We actively maintain and support the latest release of VoidDrop. We highly recommend all users and self-hosters update to the latest version immediately when updates are published.

VoidDrop is built on the principle of absolute, zero-knowledge privacy. Plaintext file contents, metadata, and encryption keys never touch any server. All cryptographic operations (ML-KEM, XChaCha20-Poly1305) run strictly on the client side inside the browser sandbox or native Tauri application.

Because of this architectural design, any potential security vulnerability is treated with the highest priority.

Please do not open public issues for security-sensitive bugs or cryptographic vulnerabilities.

If you discover a vulnerability or potential security issue, please report it privately:

1. GitHub Private Vulnerability Reporting: Go to the Security tab of the VoidDrop repository on GitHub and click on Report a vulnerability to submit a private report directly to the maintainers.
2. Codeberg Confidential Issues: Go to the Issues tab of the VoidDrop repository on Codeberg, click on New Issue, and make sure to check the "This issue is confidential" checkbox (only repository collaborators will be able to see it) to submit a private report safely.

• A detailed description of the vulnerability.
• A proof-of-concept (PoC) or step-by-step instructions to reproduce the issue.
• Potential impact (e.g., local memory leaks, remote key exhaustion, signaling manipulation).

Thank you for helping keep VoidDrop secure!