Please do not open public issues for security vulnerabilities.

Email security@codai.ro with a description, the affected protocol version (see CHANGELOG.md), reproduction steps (the exact requests and responses) and, if you have one, a proof of concept.

• Acknowledgement within 72 hours.
• Triage and severity within 7 days.
• Fix or mitigation target: 30 days (critical), 90 days (everything else).

We follow a 90-day disclosure window from the acknowledgement date. You may publish after a fix ships or after 90 days, whichever comes first; we will credit you in the release notes unless you prefer otherwise.

This repository contains a specification, JSON Schemas and example clients. In scope here:

• A design flaw in the protocol itself — for example a way for a viewer to obtain editor powers, to append events without the lease, to replay a control, to learn a link token's plaintext, or to dispatch to a device that is not the owner's.
• A discrepancy between the spec and the gateway that weakens a security property described in the spec.
• Vulnerabilities in examples/viewer.html or examples/probe.mjs.

Report implementation vulnerabilities in the live gateway (ai.codai.ro), the phone app, the desktop app or the SDKs to the same address; they are triaged together even though they live in other repositories.

• A link-share token grants its role to any authenticated codai user who presents it. The spec says to treat it like a password.
• Device ids are client-chosen UUIDs. A collision with another user's device is refused (403), not merged.
• Push (Dispatch wake) is fail-open: a failed push never fails the request; the control stays queued.