DocsPosture and advisories
Posture and advisories
What Pigeon defends, what it doesn't, and how a weakness gets fixed.
Alpha. Pigeon hasn't had an independent security audit. Use it knowing that.
Defended
- A node reading messages. Content is MLS end to end; nodes hold sealed envelopes.
- A node linking your traffic by a stable address. Mailbox identifiers rotate every epoch and derive from no key.
- Recorded traffic and a future quantum computer. The envelope layer uses a hybrid post-quantum KEM.
- A sender showing different content to a reporter. Message franking.
- A lost device. Removal from another device, and rescue with the seed phrase.
- Keys in plain files. The database key lives in the system keystore.
Not defended
- Traffic analysis. Someone who sees enough of the internet can correlate addresses and timing.
- A compromised, unlocked device. It can read what you can.
- Members sharing. Anyone in a chat can pass on what's in it.
- The MLS layer and quantum attacks. Its suite is classical (X25519, Ed25519); the post-quantum protection is in the outer layer.
- Unsigned installers. The Windows installer isn't code-signed; check its checksum (installation).
Dependency advisories
Every change is checked against a pinned copy of the RustSec advisory database before it merges, and a daily scan reads the latest one and the npm advisories. An advisory gets an automatic update where one fixes it, or a written exposure analysis and a chosen fix. No advisory is ever silenced with an ignore.
| Severity | Respond within |
|---|---|
| Critical (CVSS 9.0 to 10.0) | 24 hours |
| High (7.0 to 8.9), or a vulnerability with no rating | 3 days |
| Medium (4.0 to 6.9), unsound | 14 days |
| Low, unmaintained | 30 days |
Reporting a vulnerability
Write to security@pigeonmessage.io. We acknowledge within 5 working days and aim to fix within 90. The policy, scope and safe harbour are on security disclosure; the machine-readable contact is security.txt.