Security

This page explains how to report a vulnerability in Open Watch Party, what is in scope, how to test safely and what happens after you report.

How to report

Report a vulnerability privately, not in a public issue or pull request. Use GitHub's private reporting, or write to contact@openwatch.party.

In your report, include:

• What you found.
• The component and version.
• Steps to reproduce.
• The expected impact.

In scope

These components are in scope:

• The relay: the code in relay/, the image ghcr.io/edde746/owp-relay, and the public relays listed at https://openwatch.party/relays.json.
• The SDKs for TypeScript, Dart, Kotlin and Swift.
• The specification in spec/, where one of its rules makes a flaw unavoidable for any implementation.

For example, these are in scope:

• Acting in a room you are not in, resuming as another participant, or acting as host without being host.
• Getting around the relay's limits, or making it spend CPU or memory far beyond the traffic.
• Crashing the relay.
• Making the relay log names, codes, tokens, descriptors or addresses, or write tokens or addresses to disk.
• Making the relay show room data to anyone outside the room.
• Making an SDK fetch, open or run something, or crash its app, from a malicious relay or participant.

Out of scope

These are out of scope:

• Apps built on OWP. Report those to their developers.
• Other people's relays. Report their setup to their operator.
• Denial of service by traffic volume alone.
• Scanner reports without demonstrated impact.

Behaviour that is by design is also out of scope:

• Anyone with a code can join a room until the host locks it.
• The relay reads descriptors and positions. OWP v1 has no end-to-end encryption.
• Codes can in principle be guessed. Join limits slow guessing down.

Testing rules

Test against a relay you run yourself. The relay guide explains how to run one.

On the public relays:

• Use only your own rooms.
• Leave other people's rooms and data alone.
• Do not load-test or flood the relays.
• Stop once you have shown the issue.

Research that follows these rules is allowed under Acceptable use in the terms of use. See also the privacy notice.

What to expect

After you report:

• You get an acknowledgement within 7 days.
• Disclosure is coordinated with you, within 90 days.
• Fixes go into the latest relay and SDK releases.
• A GitHub advisory is published, with a CVE when one applies.
• You are credited, unless you decline it.

There is no bug bounty.