Toj is a messenger. Reports that affect the confidentiality, integrity or availability of user communication are taken seriously and are reviewed by a maintainer directly.

Toj has not been publicly released. There is no supported shipped version, and no user data is at risk from this repository today.

Please do not open a public issue, pull request or discussion for a security problem. A public report is readable by everyone the moment it is filed.

Use either channel:

1. GitHub private vulnerability reporting. Open the repository's Security tab and submit a draft advisory. This is the preferred route because it keeps the report, the discussion and the fix in one private thread.
2. Email. support@tojchat.tech with SECURITY in the subject line.

A useful report includes what an attacker can do, the steps or code path that gets them there, and the commit you tested against. A proof of concept helps but is not required; a precise description of the flaw is enough.

• Acknowledgement within 5 days. Toj is maintained by a small team; if you have not heard back in that window, send a follow-up.
• An assessment of severity and an intended fix window, shared with you directly.
• Credit in the release notes when a fix ships, unless you would rather not be named.

In scope. Anything in this repository: the iOS client, the backend in server/, the build and verification scripts, the CI workflows, and the deployment templates in infra/.

Out of scope. The marketing site at tojchat.tech, findings that require a physically compromised or jailbroken device, denial of service by brute resource exhaustion, and reports generated by an automated scanner with no demonstrated impact.

Do not use real people's phone numbers, messages or accounts to demonstrate a finding. If a report necessarily contains personal data, say so and we will arrange a channel for it.