Security advisories
Issues affecting released Sigil artifacts, including vulnerabilities in the third-party libraries Sigil bundles. Sigil has no auto-update and no telemetry, so this page and its feed are how you find out.
No advisories have been issued.
Found something? Write to security@sigilchat.com.
Reporting a vulnerability
Scope. The Sigil client and server, the packages on the download page, and this website. Servers other people run are theirs: test only a server you operate or have permission to test.
How. Mail security@sigilchat.com with what you found and how to reproduce it. There is no bug bounty; there is a name in the advisory, if you want it.
What to expect. An acknowledgement within 5 working days, a fix or a plan within 30 days for anything confirmed, and an advisory here and in the feed when the fix ships. Allow up to 90 days from your report before publishing it yourself; you will be told sooner if the fix is out earlier.
Good faith. Research done in good faith - no data
taken beyond what proves the issue, no disruption of other people's
servers, no social engineering - will not be reported to anyone or
pursued by Hyperion Labs. This is the policy
/.well-known/security.txt
points at.