Do NOT open public GitHub issues for security vulnerabilities. Please report security issues responsibly:

• Email: security@blackout-kit.dev
• GitHub Private Security Advisory: Report vulnerability

1. Description of the vulnerability
2. Steps to reproduce
3. Potential impact
4. Your name/handle (for credit if desired)

• Initial Response: Within 48 hours
• Status Updates: Every 7 days
• Public Disclosure: After fix is released and tested (typically 90 days max)

This app is built on the following security principles:

• VPN configs come from GitHub repositories, not hardcoded
• Users choose which repos to trust
• Transparent source control (all configs visible)

• ✅ App works entirely offline after initial config fetch
• ✅ No phone-home telemetry
• ✅ No account system or login
• ✅ No data sync to servers

• Configs, results, sources and settings are currently persisted via Hive key-value boxes without encryption at rest.
• Enabling encryption at rest requires a backup-first migration plan to avoid data loss.
• In-memory data is bounded, and no telemetry is collected or sent to remote servers.

• Zero-Allocation Socket Ring Buffers: Mitigates memory churn and denial-of-service crashes on low-RAM devices (512MB–1GB RAM).
• Constant-Time Cryptography: Auto-negotiates ChaCha20-Poly1305 on ARMv7 and older silicon lacking hardware AES-NI, eliminating cache-timing side-channel vulnerabilities inherent to software AES table lookups.

• All code on GitHub (open-source)
• No closed-source binaries
• Community code review enabled
• Reproducible builds planned

• Android: VPN permission only
• iOS: VPN configuration access only
• No camera, microphone, contacts, location, etc.

This app protects against:

• ✅ ISP monitoring of visited websites
• ✅ Regional censorship (content blocking)
• ✅ Man-in-the-middle attacks on public WiFi
• ✅ IP address leaks

This app does NOT protect against:

• ❌ Application-level leaks (DNS, WebRTC)
  • Mitigation: Always use secure DNS (DOH/DOT)
  • Mitigation: Disable WebRTC in browsers
• ❌ VPN provider snooping
  • Mitigation: Only use trusted providers
  • Mitigation: Use no-log VPN providers
• ❌ Compromised VPN server
  • Mitigation: Review server configuration source
  • Mitigation: Speed test results indicate anomalies
• ❌ Malware on device
  • Mitigation: Keep OS and apps updated
  • Mitigation: Use reputable antivirus

• Anonymous users: 60 requests/hour
• Impact: If user has 200+ custom sources, API calls may be rate-limited
• Mitigation: Implement 1-hour caching (done), display rate limit message

• URIs are parsed for basic validity (protocol, address, port)
• No cryptographic signature verification
• Impact: Compromised GitHub account could inject malicious configs
• Mitigation: Always use trusted, verified repositories

• Tests contact each server to measure speed/latency
• Impact: Reveals to VPN provider that app performed tests
• Mitigation: Can be disabled in settings, tests are optional

• Not implemented in v1.0 (Phase 5 feature)
• Impact: If app crashes, user traffic may leak outside VPN
• Mitigation: Connection status is real-time, reconnect is instant

Security review checklist for dependencies:

• Security patches: Applied immediately
• Minor/major updates: Reviewed for security implications
• Unused dependencies: Removed regularly
• Outdated dependencies: Updated quarterly

1. Run full test suite (flutter test)
2. Run static analysis (flutter analyze)
3. Check for new vulnerabilities: flutter pub outdated --dependency-overrides
4. Manual testing on real device
5. Code review by at least one contributor

• Check file integrity: SHA256 checksums provided for APK/IPA
• Verify signature: Android APK signed with official key
• Audit code: Review on GitHub before downloading

1. Immediately: Contact security@blackout-kit.dev
2. Within 24h: Create private security advisory
3. Within 48h: Assess severity and impact
4. Within 1 week: Develop and test fix
5. On release: Update version, publish fix, disclose responsibly

• Critical: Entire userbase at immediate risk → patch urgently
• High: Significant subset affected → patch within 1 week
• Medium: Limited impact → patch in next release
• Low: Theoretical/edge case → patch in next release

• ✅ Open-source license: MIT (user freedom)
• ✅ Privacy: No data collection or tracking
• ✅ No closed-source binaries
• ✅ No third-party analytics
• ✅ No advertisements
• ✅ Works offline (after initial setup)

• Use GitHub repositories from known, verified providers
• Avoid random/unknown sources
• Check recent commits and code review

• Check reported IP address (use https://whatismyipaddress.com)
• Verify VPN is connected before accessing sensitive services
• Test speed periodically (poor speed = potential issues)

• Enable automatic updates
• Check for new app versions monthly
• Review release notes for security fixes

• Change system DNS to secure provider (Cloudflare, Quad9, Mullvad)
• Disable IPv6 if you don't need it
• Test for DNS leaks: https://www.dnsleaktest.com

• Prevent traffic leaks if VPN disconnects
• Disable auto-disconnect in critical sessions
• Test kill switch regularly

• VPN Threat Model
• OWASP Top 10
• Dart Security
• Flutter Security

Last Updated: 2026-10-16
Maintained By: Blackout Kit Security Team
Contact: security@blackout-kit.dev