Security

Advisories

No advisories have been published.

Coldtill servers check this list daily and warn their admins only when an advisory affects the version they run. The same data is at /releases.json. Security fixes are free for every buyer, even after the year of updates.

Reporting a vulnerability

Email security@coldtill.com with the details and steps to reproduce. Please don't open a public issue or test against servers you don't own.

• We reply within 3 working days, and keep you updated until it's fixed.
• Critical issues get a fix or a published workaround as fast as we can, normally within 7 days.
• We credit reporters in the advisory unless you'd rather stay anonymous.
• We won't take legal action over good-faith research that respects users' data and funds.

Machine-readable: /.well-known/security.txt. How the software protects funds is in the security model.