We take the security of this project seriously. If you discover a security vulnerability, please report it responsibly.

DO NOT open a public GitHub issue for security vulnerabilities.

Email your findings to: info@gilos.email

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 5 business days
• Fix timeline: Depends on severity, typically within 30 days

The following are in scope:

• TOTP secret exposure or leakage
• Authentication bypass
• Token/session compromise
• Data exposure through local storage
• Cross-app data access
• Insecure storage of credentials

• Denial of service (DoS/DDoS)
• Social engineering
• Physical device access attacks
• Issues in third-party dependencies (report upstream)

This application implements the following security practices:

• Secure Token Storage: Access and refresh tokens stored via flutter_secure_storage (Android Keystore / iOS Keychain)
• OAuth 2.1 + PKCE: Mandatory Proof Key for Code Exchange for all authentication flows
• No Plaintext Secrets in Code: All sensitive configuration loaded from .env at runtime
• Debug-Only Logging: Sensitive debug output is gated behind kDebugMode
• Offline-First Sync: TOTP secrets are stored locally in SQLite; sync queue uses exponential backoff