Chorus operates strictly across standardized public subdomains:

• Public Site: joinchorus.app
• Application & API: chat.joinchorus.app
• Documentation & Security Guides: docs.joinchorus.app/security

We take the security and anonymity guarantees of Chorus seriously. If you discover a security vulnerability, privacy defect, or potential data leak, please report it to us confidentially before publishing it publicly.

1. GitHub Private Vulnerability Reporting: Use the Security tab on the Chorus Repository to submit a confidential advisory report.
2. Email: Send detailed disclosures to security@joinchorus.app (or maintainers at barissalih@babacan.me / baris.salih.babacan@gmail.com).

Please include:

• A description of the vulnerability and its potential impact.
• Step-by-step reproduction instructions or a minimal proof-of-concept.
• Any proposed mitigations or remediation patches.

• We acknowledge vulnerability reports within 48 hours.
• We provide periodic status updates during triage and fix implementation.
• We request that you do not publicly disclose exploitable vulnerabilities until an official patch has been released and deployed.

We are particularly interested in reports related to:

• Anonymity Breaches: Vulnerabilities that allow cross-thread correlation or unmasking of ephemeral identities.
• IP Address Leaks: Exposure of client IP addresses beyond the server layer.
• Data Integrity & Tampering: Exploits circumventing native Git append-only commit logs or moderation signatures.
• Authorization Bypasses: Bypassing admin authentication on /api/v0.1/moderation/* or /api/v1/moderation/*.
• Injection & Memory Safety: Injection vulnerabilities in Go backend, React SPA XSS, or memory safety issues.