Caelo is a censorship-circumvention tool. For some of the people who use it, a bug is not an inconvenience — it is exposure. We treat vulnerability reports accordingly.

Do not open a public issue.

Use GitHub's private vulnerability reporting on this repository. It is enabled, it reaches the maintainers, and it stays private until a fix ships.

Please include:

• what you found and why it matters;
• the version, platform and protocol in use;
• steps to reproduce, or a proof of concept;
• whether the issue is already public anywhere.

You do not need to prove impact to report something. A hunch about a traffic-analysis weakness is worth sending.

• We acknowledge reports within 72 hours.
• We aim to have an assessment back to you within 7 days.
• We will tell you honestly whether we plan to fix it, and when.
• We publish a security advisory once a fix ships, crediting you unless you would rather stay anonymous.

We will not ask you to stay quiet indefinitely. If we cannot fix an issue in a reasonable time, we would rather disclose it than leave users believing they are protected.

In scope: everything in this repository — the app and the core in core/ — along with our build and release pipeline and our subscription delivery service.

Of particular interest:

• traffic that distinguishes Caelo from ordinary traffic, or one Caelo user from another;
• leaks outside the tunnel — DNS, IPv6, traffic during connect/disconnect or on network change;
• anything that exposes which servers a user connects to;
• key, credential or subscription-link handling;
• weaknesses in signing, notarization or release integrity.

Out of scope: vulnerabilities in upstream projects that do not affect Caelo as shipped — report those to sing-box, AmneziaWG or WireGuard directly. Also out of scope: denial of service against our own infrastructure, and social engineering of the maintainers.

Only the latest release is supported. There are no releases yet.

We will not pursue legal action against anyone acting in good faith under this policy: research on your own installation, no access to other people's data, no service disruption, and a private report before disclosure. If you are unsure whether something is in bounds, ask first.