Skip to content
Synkk — Obsidian everywhere
Sign in Get Started
Security & Cryptography

Security & Vulnerability Disclosure

Responsible disclosure program, architecture standards, and safe harbor policy.

1. Security Architecture

Synkk is built from the ground up on local-first, zero-knowledge principles:

  • Client-Side Cryptography: All encrypted notes and binary attachments are transformed using AES-256-GCM with authenticated associated data (AAD) via standard WebCrypto primitives before leaving your device.
  • Key Material Isolation: Master passphrases reside exclusively in volatile client memory for the active session. Passphrases are never written to disk (`data.json`) or transmitted over HTTP.
  • Tenant Isolation & Continuous Authorization: Every API endpoint and Livewire portal interaction re-verifies tenant membership and cryptographic session grants on every single lifecycle invocation.
  • Token Lifecycle & Remote Wipe: Device tokens are hashed using SHA-256. Offboarding a team member instantly and transactionally revokes all active sync tokens.

2. Vulnerability Disclosure Program (VDP)

We welcome security researchers and community auditors to inspect and report vulnerabilities. We commit to working collaboratively with researchers who practice responsible disclosure.

Safe Harbor Guarantee:

If you conduct vulnerability research in good faith in accordance with these guidelines, we consider your research authorized, will not initiate legal action against you, and will work with you to understand and resolve the issue quickly.

3. Research Guidelines

  • Do not access, modify, delete, or exfiltrate another customer's personal data or vault content.
  • Do not execute denial of service (DoS/DDoS) attacks or degrade service availability for other users.
  • Do not engage in physical attacks, social engineering, or spam against Ottomate employees or contractors.
  • Allow us a reasonable window of 90 days to investigate and remediate reported findings before publishing any public disclosure.

4. How to Report a Finding

To report a security issue or vulnerability:

Primary Channel: Email our security team directly at security@synkk.space. Please include detailed steps to reproduce, HTTP request/response transcripts, and proof-of-concept code.

GitHub Security Advisories: You may also submit confidential security advisories directly through our GitHub repositories:

5. Response Timelines

  • Initial Acknowledgment: Within 24 hours of receipt.
  • Triage & Severity Assessment: Within 72 hours.
  • Patch Release: Critical and high-severity vulnerabilities prioritized for hotfix within 7 business days.