Please do not open a public issue for security problems.

Send the details to security@colitu.com, or use GitHub's Report a vulnerability button on the repository's Security tab. The full disclosure policy is at https://colitu.com/security#disclosure. Please include:

• the affected project and version, and your operating system,
• steps to reproduce or a proof of concept,
• the impact you expect (what an attacker could do).

What to expect:

• an acknowledgement within 3 working days,
• an assessment and a planned fix date within 10 working days,
• credit in the release notes if you want it.

Please keep the details private until a fixed version is released. We will not take legal action against research done in good faith that respects user privacy, does not degrade the service and stays within scope.

Only the latest release of each app receives security fixes. Out of scope: denial of service, social engineering, physical attacks and problems in third-party components (report those to the project concerned, e.g. Xray-core or sing-box).

The machine-readable contact is at https://colitu.com/.well-known/security.txt. The Colitu Security Whitepaper (architecture, threat model, logging, known limitations) is at https://colitu.com/security.

Пожалуйста, не открывайте публичный issue. Напишите на security@colitu.com, приложив версию, шаги воспроизведения и ожидаемое влияние. Правила раскрытия: https://colitu.com/ru/security#disclosure. Мы ответим в течение 3 рабочих дней и просим не раскрывать детали до выхода исправленной версии.