Security Notice and Project Discussions

[AntonMinin]

Security Notice

This repository is publicly available for technical review and security analysis.

Responsible disclosure

Do not report security vulnerabilities in issues or discussions.

If you believe you have found a vulnerability, report it privately:

hi@toqen.app

Please include:

• description of the issue
• affected component
• reproduction steps
• impact assessment
• supporting evidence if available

Refer to SECURITY.md for full details.

Scope of discussions

Discussions are intended for:

• architecture and design questions
• security model clarification
• integration and usage questions
• general technical feedback

They are not intended for vulnerability disclosure.

Project context

Toqen Mobile is an access-first authentication system based on:

• device-bound cryptographic verification
• short-lived authorization requests
• explicit user approval
• server-side validation of all decisions

The mobile client acts as a secure execution layer and does not grant access independently.

Status

Building continues.