If you discover a security vulnerability in signal-cli-gateway, please do not open a public GitHub issue.

Please report it privately via GitHub Security Advisories:

1. Go to the Security tab
2. Click Report a vulnerability
3. Describe the issue with as much detail as possible

You can also email libre7@proton.me with the details.

• A clear description of the vulnerability
• Steps to reproduce or a proof-of-concept
• Affected versions or configurations
• Potential impact to users

• Acknowledgment: Within 48 hours
• Assessment: Within 7 days — we'll evaluate severity and confirm whether it applies
• Fix timeline: Critical issues will be patched as quickly as possible, typically within 2–4 weeks depending on complexity
• Disclosure: We'll coordinate public disclosure with you. You'll be credited in the release notes unless you prefer to remain anonymous

• Issues that require physical access to the host machine
• Vulnerabilities in upstream projects (signal-cli, secured-signal-api) — please report those to the respective projects directly
• Theoretical attacks that require the attacker to already have root on the Docker host

The following environment variables and settings directly affect the security posture of the container:

The container runs as a non-root signal user at runtime. The config volume (/opt/signal-cli-data) contains Signal identity keys and should be treated as sensitive.