Security policy

FirstSignal is a security app made by a small independent developer. Reports about its own security are welcome.

Reporting a vulnerability

Email security@firstsignalcyber.com with:

• what you found and where (app version from About, Android version, device);
• steps to reproduce, or a proof of concept that does not harm other people;
• the impact as you see it.

Please do not report a security problem in public, such as in an issue or a store review. Reports go to the security address above. No encryption key is published, so keep secrets out of the message and share only what is needed to show the issue; we can arrange a safer channel on request. The same contact is published in machine-readable form at /.well-known/security.txt.

What to expect

• We read every report and reply as soon as we can. FirstSignal is a small independent project, so we do not promise fixed times for a reply or a fix.
• We tell you what we found, and when a fix ships.
• There is no paid bug bounty and no reward of money. We will acknowledge your report and, with your permission, credit you in the release notes.
• Please give us a reasonable time to fix an issue before you publish it. If you have a date in mind, tell us and we will work to it where we can.

Scope

In scope: the FirstSignal Android app as published on Google Play, its source code, its build and release pipeline, and this website, firstsignalcyber.com, with all of its subdomains (including the signed settings file and the optional usage-count collector).

Out of scope: services run by other people, which means the public data sources the app reads and the providers that host our website and services. Report a flaw in one of those to its owner. A mistake in how we set one up is ours and in scope. Denial of service, social engineering and physical attacks are not in scope.

Safe harbour

Good-faith research that follows this policy is authorised. We will not pursue legal action for it, and will help if a third party does. Do not access other people's data, degrade other users' service, or keep data beyond what you need to show the issue.

How the app is built

The app has no accounts, and FirstSignal does not receive the lists, settings or products a user enters; they are stored on the device. The app downloads one small signed settings file from firstsignalcyber.com about once a day, and sends anonymous usage counts to usage.firstsignalcyber.com only if the user turns that on. API keys a user adds are encrypted with a key held in the Android Keystore. Every request uses HTTPS, the app trusts only the system's certificate authorities, and it never connects to a source at an address on a local or corporate network. It never downloads or runs exploit code. The privacy policy lists every service the app contacts and what each request contains.