English
Security
If you have found something, tell me. There is no bounty programme and no legal team, just an address that a person reads.
Reporting a problem #
Email chillmate@icloud.com with "security" in the subject. Include what you did, what happened, and the version you were on. A rough proof of concept helps more than a scanner report.
You will get an acknowledgement, a fix if the finding stands, and credit in the changelog if you want it. Please give it a reasonable window before publishing, and do not test against anyone else's device or data.
What the attack surface actually is #
Most of the usual answers do not apply here, which is worth stating plainly rather than claiming as a virtue.
- No server. There is no API, no database and no admin panel to attack, because none exist.
- No accounts. No password reset flow, no session tokens, no account takeover.
- No third-party SDKs receiving your data, so no supply chain of analytics vendors.
- Sync is Apple's. iCloud sync and iCloud Drive backups run in your own account under Apple's encryption.
Here is what is left, and what is genuinely worth probing. The app lock, meaning the PBKDF2-derived PIN held in the Keychain plus Face ID, and the second PIN that opens the app empty. The encrypted backup format. The phone to watch mirror. What the widgets and Live Activities show on a locked screen, which since 5.0.0 includes a running dose and a check-in for the way home. And whether the discreet notification wording ever leaks something it should not.
If I were compelled to hand something over #
Almost nobody puts this in writing, so here it is. If a court, a police force or any other authority ordered me to produce a user's data, I would have nothing to produce. Not because I would refuse, but because there is no copy: no server, no account, no database, no logs tying a person to anything.
What I could be compelled to do is change the app, so that future versions collect something. That would be a public commit in a public repository. It would go through App Review, with a privacy label that changed from nothing to something. And it could not reach backwards to data that was never taken. If you ever see that commit with no explanation next to it, something has gone wrong, and you should stop trusting this page.
I have received no such order. If that sentence ever disappears from this page, take it seriously.
An open invitation to audit it #
I would rather be told I am wrong than be believed by default. If you work in security, harm reduction or digital rights and want to look properly, this is the scope that would help most.
- Whether the app really makes no network calls, on device, under instrumentation rather than by reading the source.
- The PIN derivation and Keychain handling, and whether the legacy migration path leaks anything.
- The encrypted backup format, and whether a backup file discloses anything without the key.
- What the widgets, complications and Live Activities expose on a locked screen. Since 5.0.0 that includes a widget for a running dose and a check-in for the way home. The route check-in carries no destination at all, and the dose widget drops the substance name when discreet wording is on. Both of those are claims worth testing rather than believing.
- Whether the duress PIN is genuinely indistinguishable from a real unlock: same screen, same timing, no failed attempt recorded, nothing anywhere saying which one was used.
- Whether discreet notification wording ever leaks a category it should not.
Email chillmate@icloud.com. I cannot pay, I can give you a build, answer questions quickly, and publish what you find whether or not it is flattering.
How I know whether this site works #
I do not, mostly, and that is a deliberate trade. This site runs no analytics, sets no cookies, and loads nothing from a third party, so there is no dashboard telling me which chapter people stop reading.
What exists is whatever GitHub records when it serves the files, which I do not control and do not process. It is a real cost: I am designing partly in the dark. It is still the right trade for a site whose readers may not want a record of having visited a page about chemsex safety.
Out of scope
- Issues in iOS, iCloud, or Apple's frameworks. Report those to Apple.
- Findings that need an already-unlocked, already-jailbroken device.
- Missing hardening headers on this static site with no login and no forms.
- Reports generated wholesale by an automated scanner with no verification.