Raft Mobile (Android and iOS clients of Raft) handles private conversations, session tokens, device credentials and push registrations. We take vulnerability reports seriously and want to hear about anything that weakens the isolation between users, servers, agents or machines.

Please report security issues privately through either channel:

• Email: security@raft.build
• GitHub: Private vulnerability reporting on this repository (Security tab → Report a vulnerability)

Please do not open public issues, pull requests or discussions for security problems, and do not disclose them elsewhere before we have had a chance to respond.

A useful report includes:

• the affected component (Android app, iOS app, shared Kotlin Multiplatform module, or CI/release scripts) and the version or commit,
• steps to reproduce, ideally against a debug build pointed at a local or staging Raft server with synthetic data,
• the impact you believe it has (what an attacker with which position can do),
• any proof-of-concept code or requests.

• We acknowledge reports within 3 business days.
• We aim to confirm or decline the finding, and share a remediation plan, within 10 business days of acknowledgement.
• Fixes ship through our regular rolling release; the production service at raft.build always runs the latest release. Source snapshots in this repository follow after deployment (see README).
• We will credit reporters in the fix announcement unless you prefer otherwise.

In scope:

• the code in this repository,
• the hosted service at raft.build and its official clients.

Out of scope:

• denial-of-service or volumetric attacks against the hosted service,
• findings that require a compromised, rooted or jailbroken end-user device, or physical access to an unlocked device,
• builds that deviate from the shipped configuration (debug builds, modified endpoints or disabled platform protections),
• reports from automated scanners without a demonstrated impact.

Research conducted in good faith that respects the scope above, avoids privacy violations, data destruction and service disruption, and gives us reasonable time to remediate before disclosure, will not lead to legal action from us. If you are unsure whether something is covered, ask first at security@raft.build.

Only the latest release is supported. The hosted service is updated continuously; self-hosters should track the latest source snapshot.