Security · coordinated disclosure

Report vulnerabilities privately.

Send suspected Suchi server or Companion vulnerabilities to [email protected] or use a private GitHub Security Advisory. Do not disclose an unresolved issue in a public issue, discussion, chat, or support request.

Private reporting routes

Email [email protected] for server and mobile reports.

Suchi server advisory Open a private GitHub Security Advisory.

Companion advisory Open a private mobile Security Advisory.

Non-security support Use support guidance instead.

What to include

Affected component and version or commit. For Companion, include its build, platform and OS version, and paired server version.
Clear reproduction steps, observed impact, and the smallest safe proof of concept.
Whether the issue is already public or appears to be actively exploited, and whether exposed credentials have been revoked.
A safe contact route and any disclosure deadline you need us to consider.

Protect credentials and documents

Never place passwords, API tokens, private keys, signing material, store credentials, private server URLs, document bytes, OCR text, personal data, or an archive backup in a report. Use synthetic data, redact logs and screenshots, and describe how to reproduce the issue locally. If sensitive evidence is essential, ask for a safe transfer method before sending it.

For server operators

Revoke exposed credentials, preserve relevant logs without copying document contents, isolate a compromised instance, and restore only from verified backups. Monitor the server advisory feed and update to a fixed release when one is published. The public project cannot access or remediate a privately operated server.

Companion release builds require HTTPS and do not forward credentials across redirects. If a paired device or token may be compromised, revoke that scoped token at the selected server and pair again only after the affected system is trusted.