# Security Policy

## Reporting a vulnerability

Report security issues privately. Do not open a public issue, pull request, or
discussion for a suspected vulnerability.

- Use GitHub's [private vulnerability reporting](https://github.com/aykutalparslan/Ferrite/security/advisories/new)
  for this repository, or
- email **aykutalparslan@msn.com**.

Please include the affected version or commit, a description of the issue, and
enough detail to reproduce it.

## Scope

Ferrite implements a messaging protocol and handles authentication keys, message
contents, and media. Reports about MTProto handling, authorization, access
control between users and channels, secret chats, and the group-call control
plane are all in scope.

Ferrite is provided without warranty under the GNU Affero General Public License.
There is no service-level commitment attached to this repository, and no bounty
program.