Please do not open a public GitHub issue for a suspected vulnerability.

Preferred reporting path:

1. Use GitHub private vulnerability reporting if it is enabled for this repository.
2. If private reporting is not available, open a public issue that asks for a security contact without including vulnerability details.

When reporting, include:

• A concise description of the issue.
• Steps to reproduce using non-sensitive test images and test messages.
• Expected behavior and observed behavior.
• Relevant platform details.
• Whether the issue affects confidentiality, decode-failure uniformity, metadata discipline, local-only behavior, or payload format.

Do not include:

• Real passwords.
• Private messages.
• Raw encrypted payload bytes.
• Real private images.
• Keys, salts paired with passwords, or crash logs containing sensitive data.

• Messages are encrypted before embedding.

• Encrypted payload format remains:

  [salt:16][nonce:12][ciphertext:N][authTag:16]
  

• No magic bytes, version fields, app identifiers, or Underlay signatures are added to encrypted payloads.

• Decode failures remain uniform as "No message found".

• Output images contain no Underlay-identifying metadata markers.

• No telemetry, accounts, analytics, server calls, or background network workflows are introduced.

• Passwords, plaintext messages, keys, derived material, and raw payloads are not logged.

Security reports are in scope for the current PNG-first desktop workflow.

Out of scope for v1 beta:

• Production JPEG support.
• Social-platform resizing/recompression resilience.
• Advanced targeted steganalysis.
• Compromised endpoints, malware, keyloggers, or hostile operating systems.
• Password compromise or password exchange.
• Traffic analysis of who shares files with whom.