Do not report vulnerabilities, survivor information, evidence, exact private locations, credentials, raw prompts/completions, or partner-confidential material in a public issue.
Use GitHub private vulnerability reporting:
https://github.com/esherialabs/saferide/security/advisories/new
If that channel is unavailable, contact Franklin Sagini at
sagini@esheria.ai and ask for a private reporting channel. Include only a
minimum synthetic reproduction, affected public revision, impact, and safe
contact method.
| Release | Support status |
|---|---|
| Latest tagged SafeRide v0.5.x Android preview | Security fixes accepted; controlled testing only. |
| Older previews and untagged builds | Best effort; upgrade to the latest public tag first. |
The Android preview is not a production, emergency-service, survivor-facing, Google Play, or UNICEF-approved release.
The project targets acknowledgement within three business days, initial triage within seven business days, and a status update at least every fourteen days until resolution. Complex or coordinated disclosures may take longer; these are response targets rather than a warranty or service-level agreement.
In scope are the public mobile app, owned API/local stack, website, public build and release automation, and public model-download integration. Testing must use accounts and synthetic data you are authorized to use. Do not access another person’s data, disrupt services, perform denial-of-service testing, or attempt social engineering.
Public disclosure should wait until a fix or agreed mitigation is available. Good-faith reports that follow this policy will be handled respectfully.