Security & responsible disclosure

Email

security@wrewtopia.com

PGP key

/security/pgp.asc · also served as /.well-known/pgp-key.txt

Web form

Not offered; email is the canonical channel. Use PGP if you would rather not share attack detail in plaintext.

Warrant canary

/canary · signed by the same key

• Acknowledgement: within 72 hours of receipt (business days).
• Triage decision: within one week of acknowledgement (in-scope, out-of-scope, or need-more-info).
• Weekly status updates for any accepted report until it is fixed or explicitly closed.
• Coordinated disclosure: we aim for 90 days from report to public advisory; we will ask for extensions on complex fixes, but we will not sit on a report indefinitely.

• Portal: portal.wrewtopia.com and all its subpaths (this site).
• Coordinator: periscope.wrewtopia.com and its subpaths.
• Published client binaries for Linux, macOS, Windows, and FreeBSD, when downloaded from an official Void Vector VPN distribution channel. The current release and one prior are both in scope.
• Cryptographic protocols we implement (VOPRF issuer, pairing-code envelope, session token cookie/binding). Findings that require breaking well-known cryptographic primitives are not automatic wins; we want construction or usage issues.

• Denial-of-service via volumetric traffic, protocol amplification, or rate-limit exhaustion.
• Social engineering of our staff, our operators, or our support inbox.
• Physical attacks against operator hardware.
• Findings against the Veilid protocol itself (report those upstream at veilid.com). Our usage of Veilid is in scope; the protocol below it is not.
• Findings against upstream dependencies (Rust crates, container base images, third-party libraries) unless we ship a specifically-configured version that materially changes their security properties.
• Self-hosted mirrors of exit nodes not operated by us; we cannot enforce policy on third-party operators.
• Reports that require an already-compromised host, root on the target system, or an already-authenticated administrator credential.
• Missing security headers on non-authenticated static pages without a proof-of-impact chain.

We authorize good-faith security research on the systems above and will not pursue legal action, civil claims, or law-enforcement involvement against a researcher whose work meets all of the following:

• The research targets only systems listed as in-scope.
• Reasonable steps are taken to avoid harm to third parties, service availability, and user data.
• User data accessed incidentally is not exfiltrated, published, retained beyond what is needed for the report, or used for any purpose other than the report.
• The finding is disclosed to security@wrewtopia.com before any public disclosure, and the coordinated-disclosure timeline above is respected.
• The research does not violate any other law that we are not empowered to waive on your behalf. This authorization covers us; it does not shield you from separate obligations to third parties whose infrastructure you may touch.

Language adapted from the disclose.io and OWASP safe-harbor templates.

Void Vector VPN does not currently run a paid bounty program. For now, in-scope reports get:

• Public credit in the hall of fame below (opt-out available).
• A CVE identifier where warranted, or an advisory in our changelog.
• Ongoing dialogue with the engineer working on the fix.

A paid-bounty table may appear here once the program has a dedicated budget; safe-harbor and triage do not depend on it.

Date	Researcher	Severity	Summary
No entries yet. Be the first.

Every published Linux (x86_64 musl) client + exit binary can be reproduced byte-for-byte from a public git tag. The runbook lives in the client repo at docs/reproducible-builds.md and pins the exact rust toolchain, cargo lockfile, and SOURCE_DATE_EPOCH used at release time. If your rebuild hash does not match the one published there, we want to hear about it via the reporting channel above.

This page and the linked artifacts are served straight from the portal container built out of our public source tree. The reference signing key at /security/pgp.asc is used to sign the warrant canary and any advisories we publish. Its fingerprint rotates only when we announce a rotation; the canary lists it explicitly on every refresh.