Only the latest release of Colitu VPN for Android receives security fixes. The app updates itself; the current version is listed on https://colitu.com/download and under Releases.

Please do not open a public issue for security problems.

Send the details to security@colitu.com. The full disclosure policy is at https://colitu.com/security#disclosure. Please include:

• the affected version and Android and Android TV version,
• steps to reproduce or a proof of concept,
• the impact you expect (what an attacker could do).

What to expect:

• an acknowledgement within 3 working days,
• an assessment and a planned fix date within 10 working days,
• credit in the release notes if you want it.

Please keep the details private until a fixed version is released. We will not take legal action against research done in good faith that respects user privacy, does not degrade the service and stays within the scope below.

In scope: this repository's code and the release files built from it (Colitu-<version>.apk), the update mechanism and the app's communication with the Colitu API.

Out of scope: denial of service, social engineering, physical attacks and problems in third-party components (report those to the project concerned, e.g. Xray-core or hev-socks5-tunnel).

The machine-readable contact is at https://colitu.com/.well-known/security.txt. The Colitu Security Whitepaper (architecture, threat model, logging, known limitations) is at https://colitu.com/security.

Every release is tagged (vX.Y.Z) and the release page lists the files and their SHA-256 checksums (SHA256SUMS). The same checksums are on https://colitu.com/open-source#verify, next to the commit each tag points to.

sha256sum Colitu-<version>.apk
apksigner verify --print-certs Colitu-<version>.apk

The update manifest (latest.json) is signed with ECDSA P-256. The app verifies the signature with the public key built into it, checks that the APK's SHA-256 matches the manifest and that the APK is signed with the same certificate as the installed app, and refuses older versions. Android itself also refuses an update signed with a different key.

Пожалуйста, не открывайте публичный issue. Напишите на security@colitu.com, приложив версию, шаги воспроизведения и ожидаемое влияние. Правила раскрытия: https://colitu.com/ru/security#disclosure. Мы ответим в течение 3 рабочих дней и просим не раскрывать детали до выхода исправленной версии.