libVES-jvm provides the Java/JNI bindings for libVES.c — end-to-end encryption software on which the confidentiality of real users' data depends. We take vulnerability reports seriously and appreciate responsible disclosure.

Please do not open a public issue, pull request, or discussion for security problems.

Email security@vesvault.com with:

• a description of the issue and its impact,
• steps to reproduce (a proof-of-concept if you have one),
• the affected version(s) or commit, and the platform (JVM/Android version, ABI).

If you need to share sensitive details, say so in your first message and we'll arrange an encrypted channel.

We aim to acknowledge a report within 3 business days and to share an initial assessment within 10 business days. We'll keep you updated and coordinate a disclosure timeline with you — please give us a reasonable window to ship a fix before going public (typically up to 90 days).

In scope: the Java and JNI binding code in this repository — correct and safe exposure of libVES.c through the JVM, key/VESkey handling across the JNI boundary, and memory safety in the native layer. Issues in the underlying cryptography belong with libVES.c.

Out of scope here: the hosted VESvault service/API (email the same address — we route it), libVES.c itself (report via the libVES.c repository), and third-party dependencies.

The recovery design and its explicit, documented threat model live in the libVES.c doc/ directory and at https://ves.host. Findings that contradict those claims are especially valuable.

Security fixes target the latest released version. Older versions are handled case by case.