Only the latest release of Colitu VPN for Linux receives security fixes. The app updates itself; the current version is listed on https://colitu.com/download and under Releases.

Please do not open a public issue for security problems.

Send the details to security@colitu.com. The full disclosure policy is at https://colitu.com/security#disclosure. Please include:

• the affected version and Linux distribution,
• steps to reproduce or a proof of concept,
• the impact you expect (what an attacker could do).

What to expect:

• an acknowledgement within 3 working days,
• an assessment and a planned fix date within 10 working days,
• credit in the release notes if you want it.

Please keep the details private until a fixed version is released. We will not take legal action against research done in good faith that respects user privacy, does not degrade the service and stays within the scope below.

In scope: this repository's code and the release files built from it (colitu-vpn_<version>_<arch>.deb, colitu-vpn-<version>-1.<arch>.rpm, colitu-vpn-<version>-linux-<arch>.tar.gz), the update mechanism and the app's communication with the Colitu API.

Out of scope: denial of service, social engineering, physical attacks and problems in third-party components (report those to the project concerned, e.g. Xray-core or sing-box).

The machine-readable contact is at https://colitu.com/.well-known/security.txt. The Colitu Security Whitepaper (architecture, threat model, logging, known limitations) is at https://colitu.com/security.

Every release is tagged (vX.Y.Z) and the release page lists the files and their SHA-256 checksums (SHA256SUMS). The same checksums are on https://colitu.com/open-source#verify, next to the commit each tag points to.

sha256sum -c SHA256SUMS --ignore-missing

The update manifest (latest.json) is signed with ECDSA P-256. The app verifies the signature with the public key built into it, then compares the package's SHA-256 with the manifest before installing it with pkexec.

Пожалуйста, не открывайте публичный issue. Напишите на security@colitu.com, приложив версию, шаги воспроизведения и ожидаемое влияние. Правила раскрытия: https://colitu.com/ru/security#disclosure. Мы ответим в течение 3 рабочих дней и просим не раскрывать детали до выхода исправленной версии.