ShieldFive takes the security of @shieldfive/cli seriously. This document
describes how to report a vulnerability, what we commit to, and the safe-harbor
terms for security researchers.
Do not open a public GitHub issue for security reports. Instead, email us directly:
- Email:
security@shieldfive.com - PGP key: Not yet published. Encrypt with a temporary key on request, or send in plaintext — we would rather know about the issue than have it sit in your inbox.
If you cannot encrypt the report, send it in plaintext anyway. We will follow up over an encrypted channel.
- A description of the vulnerability and its impact.
- Steps to reproduce, including a minimal proof-of-concept if possible.
- The CLI version and runtime environment (Node version, operating system).
- Whether the issue is already public or has been disclosed elsewhere.
- Your name and a way to contact you (or "anonymous" if you prefer).
| Severity | Acknowledgement | Initial response | Patch target |
|---|---|---|---|
| Critical (key/plaintext leak) | 24 hours | 48 hours | 7 days |
| High (integrity bypass) | 48 hours | 5 days | 14 days |
| Medium (DoS, info leakage) | 72 hours | 7 days | 30 days |
| Low (defense-in-depth) | 7 days | 14 days | 90 days |
We will:
- Acknowledge your report within the windows above.
- Keep you informed of our investigation.
- Credit you in the release notes (with your permission, or anonymously).
- Coordinate public disclosure with you, defaulting to a 90-day window.
- Publish a CVE when appropriate.
We will not:
- Take legal action against researchers acting in good faith (see Safe Harbor).
- Demand silence as a condition of bounty or credit.
Security research conducted in accordance with this policy is authorized. We will not pursue civil claims or refer law enforcement against researchers who:
- Make a good-faith effort to avoid privacy violations, data destruction, and service interruption.
- Do not access, modify, or exfiltrate data belonging to anyone other than themselves or research accounts.
- Report the vulnerability promptly through this policy's channels.
- Do not exploit the vulnerability beyond what is necessary to confirm it.
- Do not publicly disclose before we have had a reasonable opportunity to remediate (the timelines above).
There is no bug bounty. ShieldFive ran one until 2026-07; it closed, and
/security/bug-bounty now redirects to the security page. Reports are answered
on the timelines above, and credited if you want credit. They are not paid.
This section previously said the opposite and pointed at that redirected URL. It is corrected here rather than removed, so anyone who read the old text finds out what changed.
In scope: this CLI — the way it derives keys, encrypts files and filenames, constructs the upload proof, and transmits data. A demonstration that plaintext or key material can leak from this client is the highest-value report.
Out of scope for this repository (report elsewhere or not at all):
- Vulnerabilities in the cryptographic core — report those against
@shieldfive/crypto. - Vulnerabilities in dependencies (
@noble/*,@supabase/supabase-js) — report those upstream. - Server-side issues in the ShieldFive backend — same address,
security@shieldfive.com, different codebase. - Attacks that require an attacker to already control the user's device.