Security
Security and disclosure
Audit status, how to report a vulnerability, and what we commit to. Stated plainly, including the part where the audit has not happened yet.
Independent security audit: not completed yet
PrivaMesh builds on well-studied primitives - X3DH, the Double Ratchet, AES-256-GCM, and ML-KEM-768 on iOS 26. Those are proven. Our implementation of them has not been reviewed by a qualified third party. The source is public so it can be audited; until someone has, treat our claims as unverified.
When an audit is completed this page will carry the auditor, the report as a PDF, the app version and the exact commit that was reviewed.
Reporting a vulnerability
Email privamesh@proton.me with security in the subject line.
- Include the app version, your device model and your iOS version.
- Include enough detail to reproduce the issue.
- Never include your recovery phrase. We will never ask for it, for any reason, in any context.
What we commit to
- Acknowledgement within 2 business days. If you do not hear back, assume the mail was lost and send it again.
- A fix or a plan within 30 days for anything that lets someone read messages, impersonate an account, or link a user to their activity.
- Credit if you want it, silence if you do not. We will not name you without asking.
- No legal threats for good-faith research that does not target other people’s accounts or data.
Supported versions
Security fixes go to the current App Store release. PrivaMesh requires iOS 26.5 or later and has shipped one major version, so there is no older branch to backport to. When that changes, the supported window will be stated here rather than implied.
What has been fixed
Nothing has been reported and fixed yet. Rather than leave this section out, it is here empty - a list that starts at zero and grows is more informative than a section that appears only once there is something flattering to put in it.
Scope
The iOS client, the on-chain protocol, and the fee worker described on the architecture page are all in scope. Third-party infrastructure - Solana itself, RPC providers, Apple - is not ours to fix, though we want to hear about it. For the boundaries of what the design protects, see the threat model and known limitations.
Frequently asked questions
Has PrivaMesh completed an independent security audit?
No. Independent security audit: not completed yet. The implementation is open source and can be reviewed by anyone, but no qualified third party has signed off on it. When one is completed the report and the reviewed commit will be published here.
How do I report a vulnerability?
Email privamesh@proton.me with "security" in the subject line. Include the app version, your device and iOS version, and enough detail to reproduce. We aim to acknowledge within 2 business days.
Is there a bug bounty?
Not a formal programme with published payouts. We do not want to promise amounts we cannot commit to. Report anything you find and we will discuss a reward case by case, in good faith.
Which versions get security fixes?
The current App Store release. Because PrivaMesh requires iOS 26.5 or later and has shipped a single major version, there is no older branch to backport to yet.