Security

Each repository of the release has its own security policy. A flaw in the specification that an implementation follows is reported on loquitur-protocol; a flaw in one implementation is reported on its repository.

Repository	Security policy	How a release is checked
loquitur-protocol	SECURITY.md	releasing.md
loquitur-schemas	SECURITY.md	releasing.md
loquitur-verify-py	SECURITY.md	releasing.md
loquitur-verify-ts	SECURITY.md	releasing.md

How to report

In the text below, “this repository” means the repository the flaw belongs to: loquitur-protocol for the specification, otherwise the repository of the implementation.

Report a vulnerability first through GitHub’s private vulnerability reporting, on the repository it belongs to: open its Security tab and choose Report a vulnerability. The address below is the fallback when that route is not open to you.

Use GitHub’s private vulnerability reporting on this repository: open the Security tab and choose Report a vulnerability. The report is visible only to the maintainer, it carries no address that can be scraped or spoofed, and it produces an advisory record with a fixed identifier that both sides can cite later. It is the primary channel and needs nothing set up on your side.

If private reporting is unavailable to you, write to security@loquitur.dev. Keep the details of the vulnerability out of the first message if you prefer: the maintainer replies and agrees a private channel for them. Do not describe a vulnerability in a public issue.

Included from loquitur-protocol/SECURITY.md, “How to report”. MIT OR Apache-2.0.

Do not disclose sensitive material

Do not include real issuer evidence, private keys, credentials, personal data, or confidential third-party material in public issues, pull requests, discussions, or unencrypted reports.

Included from loquitur-protocol/SECURITY.md, “Do not disclose sensitive material”. MIT OR Apache-2.0.

What to expect

• Acknowledgement within 5 working days.
• An assessment, including whether the maintainer considers the report in scope, within 10 working days.
• Coordinated disclosure: the maintainer agrees a publication date with you first, and credits you unless you ask not to be credited.
• The maintainer aims to publish a fix and an advisory within 90 days of the day the report is received, and may agree a different date with you.

Included from loquitur-protocol/SECURITY.md, “What to expect”. MIT OR Apache-2.0.

Supported versions

Version	Supported
0.1.x	fixes on the default branch only

This is a pre-1.0 preview. Fixes land on the default branch, and the next release carries them; no earlier release receives a backport.

Releases are built by .github/workflows/release.yml, which attaches SHA256SUMS and a CycloneDX SBOM and records a GitHub artifact attestation for each file; docs/maintainers/releasing.md says how to check them.

Included from loquitur-protocol/SECURITY.md, “Supported versions”. MIT OR Apache-2.0.

The security considerations of the protocol

The specification’s security considerations are the threat model, part 17; its privacy considerations are in part 2. The algorithms are in part 7, cryptographic capabilities.