Bonk Security

Bonk writes to entire disks: a flaw can destroy data. Please report vulnerabilities privately, never in a public issue.

Report

GitHub private report: only the maintainer can see it.
security@bonk-os.app: encrypt any exploitable detail with the key below.

OpenPGP key

Identity	Bonk Security <security@bonk-os.app>
Fingerprint	`A782 AC57 321A 862C 2ED8 F0FB 34F1 5332 E2A0 7A30`
Expires	2028-10-30

gpg --locate-keys security@bonk-os.app

Or download the key. Compare the fingerprint.

What to expect

Acknowledgment within 7 days, first assessment within 30 days, coordinated disclosure with the fix, at most 90 days after the report unless agreed otherwise. These are objectives, not contractual commitments: the project has a single maintainer.

Policy

Full policy