Security Policy

Untrack tells people what to change on their phones, so a vulnerability here can mislead users about their own privacy. Reports are taken seriously.

Reporting a vulnerability

Please do not open a public issue. Use GitHub's private vulnerability reporting on this repository (Security → Advisories → Report a vulnerability), which creates a private thread visible only to maintainers.

Please include what you found, how to reproduce it, and what an attacker could achieve. You'll get an acknowledgement as soon as the maintainer sees it; this is a small volunteer project, so please allow a reasonable window before disclosing publicly.

What's in scope

• The content signing chain — anything that would let unsigned, modified, or replayed content be accepted by the app as genuine.
• The intake Worker (intake/) — bypassing the bot check or validation, injecting content into issues, or causing the contributor's contact detail to appear anywhere public.
• The app — leaking user data off the device, or collecting anything beyond what PRIVACY.md describes.
• Harmful or misleading suggestions in the content catalog. A tip that damages someone's privacy or security is a security issue, not just a content error.

What's out of scope

• Vulnerabilities in third-party apps or in Android itself. Report those to their vendors.
• The fact that suggestions can't be applied automatically — that's an Android restriction, described in DESIGN.md.
• Missing hardening on endpoints that hold no secrets and no user data.

Our commitments

• The private content-signing key is never committed to this repository and never ships in the app; the app carries only the public key.
• Community submissions are proposals: nothing is signed or delivered to users without maintainer review.
• The app collects nothing that identifies a user. If you find behaviour that contradicts PRIVACY.md, treat it as a vulnerability and report it.