Matrishka is a tool for keeping personal video private. Please treat security reports responsibly.

Do not open a public issue for security vulnerabilities.

• Preferred: use GitHub's Private Vulnerability Reporting (the "Report a vulnerability" button under the repository's Security tab).
• Alternatively, email universeissilent42@gmail.com with a description and, if possible, a reproduction.

Please allow reasonable time for a fix before any public disclosure.

Matrishka is pre-1.0; only the latest release is supported. Report against main or the most recent tag.

The README's Threat model section is authoritative. In short, Matrishka defends against casual inspection and simple forensic tools, but not against forensics-grade entropy analysis, coercion, known-plaintext attacks on publicly known covers, or re-muxing of the cover container.

Known cryptographic and memory-handling constraints are documented in the README under Known limitations — notably that passwords arriving as CLR strings cannot be reliably zeroed. These are documented constraints, not undisclosed vulnerabilities.

We aim to acknowledge reports within a few days and to ship a fix or mitigation as soon as practical, coordinating a disclosure date with the reporter.