If you find a security issue in SSC, please do not open a public GitHub issue with exploit details.
- Open a GitHub Security Advisory (preferred), or
- Email contact@supersecurechat.com with a clear description and reproduction steps.
We will acknowledge reports as soon as we can. Please allow time for a solo-maintainer project.
| Secret | Where it lives |
|---|---|
MONGO_URL, JWT_SECRET, CONTACT_GRAPH_PEPPER |
backend/.env, backend/cloud_run.env |
GOOGLE_CLIENT_SECRET, Firebase service account JSON |
backend/.env, backend/firebase/ |
TURNSTILE_SECRET, TURN_CREDENTIAL, VAPID_PRIVATE |
backend/.env, cloud_run.env |
REDIS_URL (contains token) |
cloud_run.env |
| Android release keystore | frontend/android/keystore.properties, *.jks |
google-services.json |
frontend/android/app/ |
| Site preview / construction passwords | frontend/.env.production.local |
| Personal tester email lists | scripts/firebase_testers.txt |
Copy from *.example files only. If a secret was ever committed, rotate it (new JWT, DB password, OAuth secret, etc.) — removing from git history alone is not enough.
- Source code is intended to be public (AGPL-3.0 + libsignal obligations on distributed APK).
- Production credentials stay on the maintainer's machine and in Cloud Run / Firebase console — not in the repo.
- User message plaintext is never stored on the server; user private keys are password-encrypted client-side before upload.
Help is welcome on: encryption flows, WebRTC signaling, Android/Electron libsignal, tests, i18n, accessibility, and documentation. Do not paste production URLs with tokens or personal emails in PRs.
A high alert count on a public repo is normal after enabling Dependabot and CodeQL — especially with Create React App (react-scripts), which pulls in many transitive dev dependencies.
| Source | What it scans | Typical noise |
|---|---|---|
| Dependabot alerts | CVEs in yarn.lock / requirements.txt |
nth-check, underscore, serialize-javascript via webpack — build-time only |
| Code scanning (CodeQL) | Patterns in our Python/JS source | Intentional localStorage in vault/session stores; OAuth redirects; test fixtures |
SSC is install-only (APK + desktop). Browser-tab chat is blocked. Many react-router CVEs target SSR / framework mode, which we do not use.
- Direct runtime deps in
frontend/package.json— e.g.axios,react-router-dom— patch/minor bumps +yarn test:ci - Backend
pipdirect deps — small grouped Dependabot PRs after CI passes - Desktop
electron— upgrade deliberately (rebuild desktop), not blind major jumps - Transitive CRA/webpack alerts — often cannot fix without migrating off
react-scripts; document and defer - CodeQL — triage: dismiss false positives (tests, encrypted vault storage) with a one-line reason; fix real issues in focused PRs
- Do not merge every Dependabot PR at once (especially major bumps: Tailwind 4, Capacitor 8, Electron 33→42).
- Do not treat alert count as “the app is hacked.”
- Do not open public issues with exploit write-ups — use Security Advisories instead.
- Review Dependabot alerts — filter Direct, sort by severity.
- Merge small patch PRs when CI and CodeQL are green.
- Dismiss CodeQL false positives on the Code scanning tab with a short note.
- Rebuild APK/desktop after client dependency changes that ship to users.
- Remaining transitive alerts under
react-scripts(long-term: CRA migration or eject) - Controlled Electron bump in
frontend/desktop(testSSC-BUILD-DESKTOP-WIN.bat) - Backend grouped minor/patch Dependabot PRs (
/backend)
main is protected on GitHub:
- Required checks:
Frontend tests,Backend tests(must pass; branch must be up to date) - Blocked: force-push, branch deletion
- Allowed: direct push by maintainer when CI is green (no PR required for solo work)
- Script:
scripts/github-protect-main.ps1(re-apply aftergh auth loginif settings are reset)