We build security products, and we want to hear about weaknesses in what we publish. If you believe you have found a vulnerability, please tell us privately first.
How to report
Email security@irythra.com with a description of the issue, the steps to reproduce it, and its likely impact. Please do not include classified information, personal data of others, or exploit code that does more than demonstrate the issue.
In scope
- The website at irythra.com and its briefing-request endpoint.
- The reference engine and lab published on this website.
- Prototype code and test vectors we have shared with you, under the terms you received them.
A known property of the reference engine is out of scope: it is correctness-oriented, not constant-time and not side-channel hardened, as stated on the status page. Weaknesses in a construction are very much in scope.
Please do not
- Access, modify or delete data that is not yours, or degrade the service for others.
- Use social engineering, physical attacks or denial-of-service testing.
- Publish the issue before we have had a reasonable chance to fix it.
What you can expect
- An acknowledgement within three working days.
- An initial assessment, and regular updates until the issue is resolved.
- Credit, if you want it, when we publish a fix.
- No legal action from us for good-faith research that follows this policy.