Security review FAQ

Short answers to the questions a reviewer asks first, with the gaps left in.

Has Pigeon been audited?

No. Pigeon is in private alpha and hasn't had an independent security audit. Don't rely on it yet where your safety depends on it.

What does it encrypt with?

MLS (RFC 9420) through OpenMLS, for one-to-one chats and groups alike, with the suite MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519. Each MLS message is sealed again, to the recipient's device, with HPKE (RFC 9180), so a server holds only an opaque envelope. See group encryption.

Is it post-quantum?

Partly. The outer seal uses X-Wing, a hybrid of ML-KEM-768 and X25519, as do device and device-linking keys Built. The MLS layer itself is still classical X25519 and Ed25519 until a final post-quantum MLS suite exists Planned. We haven't analysed how far the outer seal alone protects against traffic recorded now and attacked by a quantum computer later, so we don't claim it does.

What do the servers see?

A mailbox node sees sealed envelopes, a mailbox id that changes every epoch, sizes, arrival times, and the network address of a connection while it's open. It sees no account, group id, epoch or sender, and Pigeon's nodes keep no per-request log of addresses. Envelopes have a minimum size but aren't padded to buckets yet, so a network observer can still correlate by size and timing Planned. More in the threat model.

Does Pigeon scan messages?

No. Nothing is scanned, classified or flagged. Abuse reaches Pigeon only when someone in the conversation reports it; see reporting and franking.

Is there unsafe code?

Every Pigeon crate, every binary and every test root carries #![forbid(unsafe_code)]. Dependencies (the crypto libraries, SQLCipher, the web view) do contain unsafe and native code.

How is it tested?

• Test vectors for each wire format and primitive, generated independently of the Rust code.
• The group-commit protocol is model-checked in TLA+ (ordering).
• Soak tests on a five-node swarm with crashes, wiped nodes and partitions (reliability).
• A register of controls, each listed only after it has been seen to fail when broken on purpose.
• Mutation-testing scores are measured but not yet a gate; there's no fuzzing yet Planned.

What about dependencies?

A licence and advisory check runs before every change can land, across nine target platforms. Allowed licences and the few named exceptions are on the licences page.

Are the downloads signed and reproducible?

Not yet. Each download has a SHA-256 checksum on the download page, but a compromised host could change both the file and the checksum. Signed installers, reproducible builds and a public log of releases are Planned.

What if someone shows me a fake key?

Today, nothing would catch it. Every key shows as “pending verification” until the key log ships Planned, and there's no in-app way yet to compare keys in person.

What if my laptop is stolen?

Its data is encrypted with a key in the OS keystore (desktop app). An unlocked, stolen device can read and send as you until you revoke it from another device or rotate with your seed phrase. Malware on an unlocked device is out of scope for any messenger, including this one.

How do I report a vulnerability?

Email the address on the security page, also published in /.well-known/security.txt. We acknowledge within 5 working days, aim to fix within 90, and offer safe harbor for good-faith research.

Sources: docs/THREAT_MODEL.md, docs/CONTROLS.md, ADR-0001 (sealed envelopes), ADR-0006 (ordering), ADR-0008 (device store), ADR-0014 (desktop builds), ADR-0015 (what Pigeon holds); crates/pigeon-core/src/seal.rs, crates/pigeon-core/src/client.rs.