Plazer security: what protects you today and how to report a vulnerability

Plazer has been running in production since 22 October 2026. Here we describe, without polish, what already protects accounts and conversations, what nobody outside has checked yet, what the audit before version 1.0 will cover and how to report a vulnerability so it goes straight to the people who write the code.

Report a vulnerability What works today

.well-known/security.txt

1Contact: mailto:kontakt@plazer.org
2Expires: 2027-10-24T00:00:00.000Z
3Preferred-Languages: pl, en
4Canonical: https://plazer.org/.well-known/security.txt
5Policy: https://plazer.org/pl/bezpieczenstwo/#zglaszanie
6Policy: https://plazer.org/en/security/#reporting

Where things stand today, said plainly

A messenger's security is not only its encryption but also who checked it and how closely. This is where we are today.

Plazer: In production since 22 October 2026: the app at app.plazer.org, the central server at api.plazer.org and the community server at srv.plazer.org.
Encryption: The MLS standard (RFC 9420) on the mls-rs library. Its authors have validated it against the standard but state plainly that the library has not yet had a full third-party security audit.
Plazer code: The encryption core, the central server, the community server and the app have not had an external audit yet. We plan a cryptography audit before version 1.0.
Reports: We take vulnerability reports today at kontakt@plazer.org and reply within 72 hours.

A cryptography audit before version 1.0

The audit will cover four parts of Plazer, everything your keys and messages pass through. We will describe its results and the list of fixes on this page.

01
The plazer-core encryption core
- Use of MLS and the mls-rs library
- Account and device keys, the device list and revocation
- Encryption of files and voice messages
- Pairing a new device and recovering an account
02
The central server at api.plazer.org
- Sign-up, sign-in, sessions and the second factor
- Credentials, issuing keys and the revocation list
- Delivery of encrypted messages and attachments
- Notifications and the relay for community servers
03
The community server
- Signing in with a central server credential
- Channel, role and administrator permissions
- Claiming a server and the ownership chain
- Private channels and voice calls
04
The app from app.plazer.org
- Storing keys in the browser
- Code delivery and the pinned central server key
- Safely showing content from others
- Data export and account deletion

What protects accounts and conversations today

Every point below describes a mechanism that works in the current version of Plazer, not a plan.

MLS in every private conversation

Direct messages, groups and private channels are encrypted by the plazer-core core in Rust, on the mls-rs library, with the MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519 suite.

A pinned central server key

Every app release has the central server's public key built in and cannot open any encrypted conversation without it. The matching private key never sits on the servers.

A reproducible core build

We build the core from a pinned version of its code in a fresh copy of the repository. Every release records the code version, the tools, the SHA-256 of the module and the pinned key.

Keys stay on your device

Private keys are created in the browser and never leave the device, and where the browser supports it they cannot be exported. The recovery key never reaches the server.

Passwords and the second factor

We keep passwords as bcrypt hashes and encrypt authenticator secrets and backup codes with AES-256-GCM. Five wrong codes end an attempt, and ten within 15 minutes lock the account for a while.

Sessions and new sign-ins

The server stores only a hash of each session token. A sign-in from a new browser goes into the security log, and the account's other sessions see it at once.

Files in a sandbox

Attachments are served with headers that block code from running, and files other than images, audio and video are always download-only. The server fetches previews and pictures from public addresses only.

A block applies everywhere

A blocked or deleted account goes onto the revocation list that community servers read, including those run by others. Such an account cannot sign in to any of them.

How to report a vulnerability

Found a bug that could put accounts or conversations at risk? Write to us before you talk about it publicly. The people who write Plazer will answer.

1Write to kontakt@plazer.orgPut "Vulnerability" in the subject. Describe the problem, the steps to reproduce it, the possible impact and the part of Plazer it affects. Do not publish details in channels or on the community server.
2We reply within 72 hoursWe confirm the report arrived, tell you whether we could reproduce the problem and keep you updated on the work on a fix.
3We agree on disclosureThe fix goes to app.plazer.org and our servers, and we set the date for publishing details together with you. If you like, we will thank you publicly by name or nickname.

Write to kontakt@plazer.org

72 hto the first reply

Testing rules

Test only on your own accounts and servers. The best place is your own community server started from the Docker image.
No denial-of-service attacks, spam, social engineering or attempts at physical access.
Do not read, change or delete other people's data. If you come across it, stop and describe it in your report.
Do not keep access longer than you need to demonstrate the problem.

Out of scope

Community servers run by others. Report the problem to their operator and, if it concerns the server code itself, to us as well.
Automated scanner output without a demonstrated real impact.
Vulnerabilities in browsers and operating systems. Report them to their vendors.

We will not take legal action against people who act in good faith under these rules. We do not run a paid bounty programme today.

The same details are in the security.txt file at plazer.org/.well-known/security.txt, in the RFC 9116 format.

Questions about security

Short answers to what people ask when they check Plazer before trusting it.

Not yet. The mls-rs library the encryption rests on is validated against the MLS standard but has not yet had a full third-party audit. We plan a cryptography audit of Plazer before version 1.0 and will describe its results on this page.

Because the app code comes from app.plazer.org every time it starts, the installed version included. The pinned central server key and the reproducible core build with a recorded checksum limit that risk, and the way code is delivered is part of the planned audit.

Only on your own accounts and without loading the server. For deeper testing, run your own community server from the public Docker image: it works the same way and you touch nobody else's data.

On our community server, in the bugs channel. Report vulnerabilities only to kontakt@plazer.org, so the details do not reach everyone before a fix exists.