Responsible Disclosure
How to Report
Send vulnerability reports to: matarmohamad313@duck.com
Subject line: [CVE DISCLOSURE] Brief description
Include: affected component, reproduction steps, impact assessment, and your contact information for credit.
Our Commitment
- Acknowledge receipt within 24 hours
- Provide a timeline for resolution within 72 hours
- Credit researchers in our changelog (unless anonymity requested)
- Not pursue legal action against good-faith researchers
- Coordinate public disclosure timing with the reporter
Scope
✅ In Scope
- Shadow313 CLI v1–v4 (github.com/piyyy314/Shadow313-Nexus)
- shadow313.dev and shadow313.com web properties
- 313-BIND temporal binding protocol implementation
- FastAPI audit server (localhost:8000)
- Plugin system and HMAC signing
- Docker Compose stack and Dockerfile
- Ollama model (matarmohamad313/shadow313-nexus)
❌ Out of Scope
- Third-party dependencies (report upstream)
- Social engineering attacks against team members
- Physical security attacks
- Denial of service attacks
- Automated scanning without prior permission
- Issues in third-party services (Vercel, GitHub, Cloudflare)
Known CVEs & Security Advisories
| ID | Component | Severity | Status | Fixed In |
|---|---|---|---|---|
| S313-CVE-2026-001 | Session path traversal (encrypted writes) | HIGH | ✅ Fixed | v4.0.1 |
| S313-CVE-2026-002 | SSRF in AI engine URL handling | MEDIUM | ✅ Fixed | v4.0.1 |
| S313-CVE-2026-003 | Crypto downgrade to plaintext on import failure | HIGH | ✅ Fixed | v4.0.1 |
| S313-CVE-2026-006 | ECDSA P-256 cosign in plugin_signer.py (CRQC) | CRITICAL | 🔄 Migrating | v4.1.0 (Q4 2026) |
Bug Bounty Program
Shadow313 operates an informal bug bounty program. Rewards are at our discretion based on severity and impact:
| Severity | Examples | Reward |
|---|---|---|
| Critical | RCE, auth bypass, key extraction | $500–$2,000 + CVE credit |
| High | Path traversal, SSRF, privilege escalation | $100–$500 + CVE credit |
| Medium | Information disclosure, CSRF | $25–$100 + credit |
| Low | Minor issues, best-practice violations | Public credit + swag |