Security: no working private disclosure channel (security@ bounces, private reporting off)

[SaschaHeyer]

Hi maintainers. I tried to report a security issue privately and could not reach a working channel:

• The security contact in SECURITY.md and README (security@streamize.net) bounces with "Address not found."
• GitHub private vulnerability reporting is not enabled on this repo.

I have a write-up of a concern about the session_start auto-update path (unsigned code fetched and executed). Please provide a working security contact, create the security@ mailbox, or enable private vulnerability reporting.

(Note: I already emailed admin@streamize.net on 2026-07-01 at 12:50 CEST. This issue is a fallback because that address has not responded.)

[nullarch]

Thank you for the careful, responsible disclosure — and apologies that the private channel didn't work; that's on us.

Auto-update (unsigned exec): fixed in #1. The updater now downloads the installer plus a detached Ed25519 signature, verifies it against a public key baked into the client, and executes only on a valid signature — fail-closed on a missing/invalid/placeholder key, with all three curl | bash / iwr | iex / python exec paths removed. It ships with auto-update off until a real signing key is provisioned, so there's no unsigned-exec window in the meantime. (RFC 8032 known-answer + tamper-rejection tests, a PyNaCl cross-check, and a real-Linux end-to-end are included; CI is green across macOS/Ubuntu/Windows.)

Disclosure channel: we're fixing the security@ contact and enabling GitHub private vulnerability reporting so a report like yours reaches us properly next time. Sorry again for the bounce.

Really appreciate you pushing us to close this the right way. 🙏