Security10 of 10
Reporting a vulnerability
Do not open a public issue for a security problem.
The security contact is the form at kotoba.rodhnin.com/report. If you would rather stay on GitHub, a security advisory is private until a fix ships and keeps the report attached to the code.
Say what you did, what happened, and what you expected. A proof of concept helps and is not required.
What happens next
| Stage | What to expect |
|---|---|
| First reply | within 14 days, saying whether it reproduces — usually much sooner |
| While it is open | you are told what is being done, and asked before anything is published |
| Disclosure | when the fix ships, or 90 days after the report, whichever comes first |
| Where | as a published advisory on the repository, and a CVE where one is warranted |
| Credit | your name in the advisory, or none at all — your choice |
The 90 days is a ceiling, not a target. If you need longer, say so and it will be honoured; if the problem is already public, disclosure is immediate. There is no bug bounty: this is a small project and there is no money in it.
Supported version: the latest release. Older versions get no backports — the fix is the upgrade.
In scope
Kotoba running as documented, on a machine you control: the backend, the terminal, the web UI, the Discord bot, and the packaged wheel.
Out of scope
Not because they do not matter, but because they are the product working as designed and documented on these pages:
- Anything she does after you approve an approval card. The card is the boundary. See The approval gate.
- Everything on the "what does not protect you" lists in this section — the denylists, the unaudited reads, the writes that carry no card, the working directory not being a cage.
- Ordinary commands under
KOTOBA_SANDBOX=docker, where the container is the boundary and a card is deliberately not shown. See The sandbox setting. - Exposing the backend to a network without setting a gate password. See The web gate.
- Third-party services she talks to — report those to the service.
If you think one of those defaults is itself the wrong call, that is a good issue and a good discussion. It is just not a vulnerability report, and it belongs in public where it can be argued.
Testing safely
Test against your own install. Do not test against anyone else's machine, and do not use a vulnerability to reach data that is not yours.
A report made in good faith under those terms will be treated as help, not as an attack, and no legal action will be sought over it.