# VeloraMesh Security Policy

Effective date: 2026-09-05
Version: v1.0.0-rc2

## Supported Versions

Only the latest published v1 release-candidate package is supported for
security testing and fixes.

## Security Posture

VeloraMesh v1 uses modern cryptographic building blocks and a conservative
membership model:

```text
TLS 1.3 for the control plane
SHA-256 SPKI pin support
Ed25519 device identity
X25519 peer key agreement
HKDF-SHA256 key derivation
XChaCha20-Poly1305 peer data-plane AEAD
AES-GCM encrypted UDP discovery
HMAC-SHA256 discovery material derivation
local PBKDF2-HMAC-SHA256 join-key derivation with 600000 iterations
Ed25519 join proof with server-side public verifier storage
membership tickets for peer authorization
replay windows for encrypted peer frames
rate limits for sensitive control-plane routes
```

VeloraMesh has passed local automated checks for the v1.0.0-rc2 snapshot,
including unit tests, race detector, static analysis, security scanning, Android
lint/build, and release package audit.

## Claim Boundaries

Allowed public wording:

```text
VeloraMesh uses strong modern cryptography and has passed local automated
security and quality gates.
```

Do not claim:

```text
military-certified
unbreakable
zero-risk
formally verified
independently audited
WireGuard-equivalent security maturity
```

Independent cryptographic review and penetration testing are still required
before stronger public claims.

## Reporting Vulnerabilities

Report security issues privately to the project owner before public disclosure.
Include:

```text
affected version
platform
impact
reproduction steps
logs or packet captures if safe to share
whether secrets, device IDs, or endpoints are included
```

Do not include real join secrets, private keys, production tokens, or customer
topology unless explicitly requested through a secure channel.

## Research Rules

Security testing must be performed only against systems you own or are
authorized to test.

Do not:

- attack third-party devices or networks;
- attempt persistence or data exfiltration;
- publish exploit details before a fix window;
- disrupt production users.

## Known v1 Limitations

```text
No independent external audit yet
No formal verification yet
Persistent fuzz targets cover the core wire parsers, but long-running independent fuzz campaigns remain a release-hardening target
macOS/Linux secret storage is permission-based rather than native keychain-backed
server-side revocation is bounded by ticket/refresh behavior because traffic is direct P2P
desktop/server installers and the public update channel are not yet code-signed; RC2 checksums are published and the Android APK is signed
```
