The Dangerzone team welcomes feedback from security researchers and the general public to help improve our security. If you believe you have discovered a security issue, we want to hear from you. This policy outlines steps for reporting vulnerabilities to us, what we expect, what you can expect from us.

Please do not report security vulnerabilities through public GitHub issues.

Our preferred communication channels are:

• Signal: Not yet publicly available. Please contact us via email and we will provide you with Signal contact details for secure communication.
• Email: support@dangerzone.rocks.

A member of our team should acknowledge your report within 2 weeks. If we fail to do so, please use a different communication channel.

Once we have acknowledged the report, we ask for at least 6 weeks to investigate, implement, and release a fix before any public disclosure, unless we mutually agree on a different timeline. During that time we will keep you updated as we make progress, and we will be available for any question you may have. If we determine that a coordinated public disclosure is necessary before a fix is ready, we will work with you on messaging and timing.

Dangerzone has two main security goals:

• Malicious documents should not infect the user's device, or communicate with other machines.
• All metadata should be destroyed after the conversion process.

Any vulnerability that undermines these two goals is considered critical and we advise you to report it via Signal.

Dangerzone uses several third-party tools to sanitize documents, such as LibreOffice and PyMuPDF. Because these tools have a large attack surface, Dangerzone operates under the assumption that a 0-day vulnerability probably exists for them. For this reason, Dangerzone's primary defense is to isolate these tools within unprivileged, networkless containers using gVisor. Read more in our blog.

Our second line of defense is to make sure our container image is not affected by known vulnerabilities, i.e., CVEs. We have nightly security scans for Critical CVEs, and biweekly security scans for High CVEs. You can see the results of our security scans in https://cves.dangerzone.rocks. We aim for a 4 week update cadence of our container image, or earlier, if a security finding necessitates it.

If you have encountered a CVE in our container image that violates the above policy, please report it to us.

When necessary, we have issued CVEs for Dangerzone and security advisories to our users. We are committed to transparency and will continue to issue CVEs and security advisories whenever a finding warrants it.