For security inquiries, please follow the disclosure process below.

If you discover a security vulnerability in Tryx, please report it responsibly. Do not open a public GitHub issue for security vulnerabilities.

1. Email: Send a detailed report to krypton-byte via GitHub's private vulnerability reporting feature, or open a Security Advisory.

2. Include:

   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Any suggested fix (if available)

3. Response time: We aim to acknowledge reports within 72 hours.

The following are considered in-scope for security reports:

• Protocol handling — Rust core logic for Signal protocol, encryption, and key exchange
• PyO3 bridge — Type conversion, GIL management, and error marshaling between Rust and Python
• Session storage — SQLite, FFI, and Python store backends
• Media processing — Upload, download, and transcoding paths
• Authentication — Pairing, session persistence, and credential handling

• Issues in third-party dependencies (report upstream)
• Denial of service against WhatsApp servers
• Social engineering attacks
• Issues requiring physical access to the target device

• We follow a coordinated disclosure process.
• We will work with you to understand and address the issue before any public disclosure.
• Once a fix is released, we will publicly acknowledge the vulnerability and credit the reporter (unless anonymity is requested).

• Keep Tryx updated to the latest version.
• Use environment variables or a secrets manager for sensitive configuration.
• Restrict admin-level bot commands to authorized users.
• Monitor EvTemporaryBan events for rate-limit violations.
• Use a dedicated WhatsApp account for automation (not your personal account).