If you find a security vulnerability in any Brivora package, please report it responsibly.
Email: security@brivora.dev
We will acknowledge receipt within 24 hours and provide a detailed response within 72 hours. We will not take legal action against security researchers acting in good faith.
PGP Public Key: pending — key generation in progress
@brivora/crypto implements NIST post-quantum cryptographic standards:
All PQC operations use @noble/post-quantum. Classical operations use @noble/curves and @noble/hashes. Zero custom cryptographic primitives.
No independent security audit has been completed yet. First audit to be commissioned with grant funding, targeting Cure53, Trail of Bits, or NCC Group. Full audit report will be published on-chain.
Formal bug bounty program coming. Until then, email security@brivora.dev. We will credit all valid reports.
Access Brivora from anywhere, without surveillance or censorship.
Tor mirrors: pending — .onion addresses will be published here when enabled
Download Tor Browser: torproject.org
Security is one dimension of the Trust Stack — 10 layers of verifiable trust. Read the full Trust Stack ->