RESPONSIBLE DISCLOSURE

Security Policy & Assurance

Entangl is designed from ground zero to protect human lives and sensitive communications. We maintain strict transparency, reproducible code verification, and a rigorous vulnerability disclosure program.

1. Reporting a Vulnerability

If you have discovered a potential security vulnerability in the Entangl Android application, cryptographic protocol, or related infrastructure, please report it immediately to our security team. Do NOT create a public GitHub issue.

PRIMARY SECURITY DISCLOSURE CONTACT

Email: security@grayscales.in
Encrypted PGP submissions are strongly encouraged.

Please include the following in your report:

  • Component affected (e.g., QR Handshake state machine, SQLCipher key derivation, Tor arti integration, UI layer).
  • Step-by-step reproduction instructions or a minimal Proof of Concept (PoC).
  • Severity assessment and potential impact on confidentiality, integrity, or anonymity.

2. Response Timeline & Coordinated Disclosure

We treat all security reports with highest priority and adhere to a 90-day coordinated disclosure policy:

  • Initial Acknowledgment: Within 48 hours of receipt.
  • Triage & Impact Assessment: Within 5 business days.
  • Patch Remediation: Target fix deployed to main branch and tagged release within 14 days for Critical/High severity issues.
  • Public Advisory & CVE: Published concurrently with the patched binary release.

3. Official Security PGP Key

Verify all security advisories and encrypted communications using our team's PGP key:

entangl_security_pubkey.asc 
# Key ID: 0x90BC12F4
# Fingerprint: 7F2A 99B1 04CD 881E 34B2 91A0 CE81 4452 90BC 12F4
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: OpenPGP.js v4.10.10
Comment: https://entangl.grayscales.in/security.html

mQENBF+1x98BCADU6b4u9v...[ENTANGL OFFICIAL SECURITY TEAM KEY]...
=4u9v
-----END PGP PUBLIC KEY BLOCK-----

4. Core Security Principles

  • Zero Knowledge: We cannot be compelled to surrender data we do not possess. There are no user accounts, phone numbers, or cloud databases.
  • Post-Quantum Defense: Hybrid ratchets with ML-KEM-768 Kyber ensure resistance against future quantum computer decryption.
  • Native Memory Zeroization: Ephemeral keys in NativeKeyBuffer are erased with sodium_memzero() immediately after each cryptographic operation.
  • Physical Isolation: Contact discovery is strictly physical out-of-band to prevent remote scanning and bot scraping.
  • Open Source Integrity: 100% auditable code under AGPLv3. All research and data extraction are welcomed.

5. Binary Verification & Release Signatures

Every release published to GitHub or Google Play is cryptographically signed. You can verify APK integrity directly from terminal:

verify_signature.sh BASH 
# Download APK and detached signature
curl -O https://github.com/hkbagh/Entangl/releases/download/v1.0.0/entangl-v1.0.0-release.apk
curl -O https://github.com/hkbagh/Entangl/releases/download/v1.0.0/entangl-v1.0.0-release.apk.asc

# Verify GPG signature against official release key
gpg --verify entangl-v1.0.0-release.apk.asc entangl-v1.0.0-release.apk

6. Hall of Fame & Recognition

We gratefully acknowledge researchers who responsibly disclose vulnerabilities in Entangl. Researchers will be featured in our official Security Hall of Fame and release notes.