Security

Report vulnerabilities privately to gian2automation@gmail.com. Do not include real recovery words, nsec/private keys, passwords, session cookies, contact details, managed backups, or decrypted relay events in a report.

Grava encrypts application payloads, but it does not hide all metadata. A relay can observe recipient public keys, network addresses, timing, and ciphertext sizes. Push providers observe device delivery metadata. A friend can retain information after receiving it, so disconnecting cannot make previously shared information disappear. Regular accounts are recoverable and therefore trust the auth service and its separately held managed-key keyring; use self-custodied Nostr mode when that trust model is unsuitable.

Production releases require dependency pinning, protocol-vector tests, a restrictive web Content Security Policy, and an independent cryptography review. Current accepted build-tooling risks are recorded in the repository's docs/threat-model.md; they are not blanket exceptions for future advisories.

Supported security fixes target the latest tagged release. Until v1.0.0 is tagged and the independent review is complete, all builds are pre-release. Maintainers should acknowledge a credible private report within three business days and avoid requesting recovery words, private keys, OTPs, session material, or decrypted user content.