Security

Overview

/ disclosure policy

GChat operates under coordinated-disclosure principles. If you discover a vulnerability, work with us and we work with you. This page and our security.txt describe the expected process.

Scope

• In scope: gchat.tech and all subdomains, iOS and Android clients, the published GChat protocol implementation.
• Out of scope: third-party hosting providers, physical attacks, social engineering of GChat team members, denial-of-service testing.

How to report

1. Email security@gchat.tech with a clear technical description, reproduction steps, and (if applicable) a proof-of-concept.
2. We acknowledge within 3 business days.
3. We triage and communicate a projected fix timeline within 10 business days.
4. We aim to ship a fix and publicly disclose within 90 days. For critical issues we may move faster; for deeply architectural issues we may ask for more time with your explicit agreement.

Rewards

We are a pre-beta project with no monetary bounty program yet. As soon as we have the budget for it, this section will describe the program. In the meantime we can offer public acknowledgment, a thank-you, and — if you want one — a signed GChat swag package.

Safe harbor

We commit to not pursuing legal action against good-faith researchers who stay within the scope above, avoid privacy violations and service disruption, and give us reasonable time to respond before any public disclosure.

Acknowledgments

Researchers who responsibly disclosed issues will be listed here, with their permission. None yet — you could be the first.