Убрать дедлайн нельзя, только отложить его на ровном месте.
We take security seriously. BitNet is an offline password manager with Zero Trust architecture. All user data remains on the local device.
| Version | Supported |
|---|---|
| 0.1.x | ✅ Active |
| < 0.1 | ❌ Not supported |
Please DO NOT open a public issue for security vulnerabilities.
Send reports to: security@bitnet.dev (PGP key below)
- Clear reproduction steps
- Affected component (Rust core / C# GUI / browser extension / CLI / installer)
- CVSS estimate (if possible)
- Minimal test case or proof-of-concept
- Your disclosure timeline preference
| Stage | Timeline |
|---|---|
| Acknowledgment | Within 48 hours |
| Initial assessment | Within 7 days |
| Fix + patch release | Within 30 days (Critical/High) |
| Public disclosure | Coordinated with reporter, 90 days max |
Components in scope:
- Rust workspace (
crates/*,bitnet-cli/) - C# WinUI 3 application (
BitNet.Desktop/) - Browser extension (
browser-extension/) - Installer (
scripts/bitnet-setup.iss) - Native Messaging host (
crates/bitnet-native-host/)
Out of scope:
- Physical device access (if encrypted, BitNet cannot help)
- OS-level vulnerabilities (report to Microsoft)
- Third-party browser vulnerabilities (report to vendor)
| ID | Risk | Reason | Mitigation Plan |
|---|---|---|---|
| L-002 | UTF-8 lossy conversion for passwords with invalid bytes | C ABI limitation | Documented; all interfaces treat passwords as UTF-8 |
Recently closed (v0.1 hardening): M-004 (wildcard
allowed_origins), L-003 (origin not validated in native host), L-004 (clipboard not auto-cleared), plus H1-H3 / M1-M5 / L1-L6 from the internal SECURITY_AUDIT.md. See docs/SECURITY_NOTES.md for the current list.
We run a public bug bounty program for responsible disclosure. Full details:
- Program overview:
docs/BUG_BOUNTY.md - Researcher hunting guide:
docs/BOUNTY_HUNTING_GUIDE.md - Internal triage guide:
docs/BOUNTY_TRIAGE_GUIDE.md - Contact:
security@bitnet.dev(PGP key below) - Scope: All components in this repository (Rust crates, browser extension, C# desktop, CLI)
- Bounty range: $100 – $5,000 (see program for full matrix)
- Hall of Fame: See below
(No reports yet — program launched 2026-06-01)
- Default: 90 days from report
- Critical: 14-day patch deployment SLA
security@bitnet.dev
Fingerprint: [TO BE PUBLISHED ON FIRST BOUNTY LAUNCH]
All CI builds enforce:
- Control Flow Guard (CFG)
- ASLR (
/DYNAMICBASE) - CET Shadow Stack (
/CETCOMPAT) - Code signing (production builds only)
- cargo-deny — banned crate patterns, license policy, and yanked-package check (see
deny.toml) - Pre-commit secret scan — runs before every commit to detect hardcoded secrets (
scripts/pre-commit-secret-scan.ps1) - Fuzzing gate — 120-second run of the KDBX deserializer fuzz target (
cargo +nightly fuzz run kdbx_deserialize -- -max_total_time=120)
All policies, thresholds, and allowed test fixtures are defined in .cargo/security.yaml, which is the source of truth for security enforcement configuration.