Public announcements of new releases with security fixes and of disclosure of any vulnerabilities will be made in the Celo Forum's Security Announcements channel.

We’re extremely grateful for security researchers and users that report vulnerabilities to the Celo community. All reports are thoroughly investigated.

The Celo community asks that all suspected vulnerabilities be privately and responsibly disclosed.

1. Submit your vulnerability to Celo on Intigriti.
   • This is currently a private program, and a public launch has been planned. If you would like to participate in the private program please create an account on intigriti.com, and send an email to intigrity.com support asking them to invite you to this program.
2. You can also email the [email protected] list with the details of reproducing the vulnerability as well as the usual details expected for all bug reports.

• Celo protocol, but the team may be able to assist in coordinating a response to a vulnerability in the third-party apps or tools in the Celo ecosystem.

• Shared links leaked through the system clipboard
• Any URIs leaked because a malicious app has permission to view URIs opened
• The absence of certificate pinning
• Sensitive data in URLs/request bodies when protected by TLS
• Lack of obfuscation
• Path disclosure in the binary
• Lack of jailbreak & root detection
• Crashes due to malformed URL Schemes
• Lack of binary protection (anti-debugging) controls, mobile SSL pinning
• Snapshot/Pasteboard leakage
• Runtime hacking exploits (exploits only possible in a jailbroken environment)
• API key leakage used for insensitive activities/actions
• Attacks requiring physical access to the victim's device

• What will happen if a vulnerability is reported and is known to the company from their own tests,?

  • It will be flagged as a duplicate

• What kind of exploits are excluded from the program or may be lowered in severity?

  • Reports that state that software is out of date/vulnerable without a proof-of-concept
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces
  • Issues that would require complex end user interactions to be exploited, may be excluded or be lowered in severity
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that are limited to non-current browsers (older than 3 versions) will not be accepted
  • Attacks requiring physical access to a victim’s computer/device will not be accepted.
  • Man in The Middle
  • Compromised User Accounts

• Do you accept recently disclosed zero-day vulnerabilities?

  • We need time to patch our systems just like everyone else - please give us 2 weeks before reporting

PGP Fingerprint ID: A22B62A5EAFB6948