Security
Our mission is to protect your privacy through proven cryptographic protocols and transparent security practices.
# Last updated: 27 July 2026
Current Limitations
Kursal has not been audited by an independent third party, and it is public beta software. Use it accordingly. If your safety depends on a messenger today, use one that has been audited.
Some weaknesses are inherent to the design rather than bugs waiting to be fixed, so it is only fair to name them here rather than leave them in the paper:
- ▸ Contacts added with a Long-Term Code have weaker forward secrecy for the first few messages of a conversation, until the Double Ratchet takes its first step. Contacts added with a one-time password or Nearby Share do not have this trade-off.
- ▸ Peer ID rotation hides you from passive observers, not from a relay that is actively carrying your traffic. That relay sees a stable IP address, and the address update you send after rotating links your old and new IDs. Use Tor or a VPN if that matters to you.
- ▸ Encryption protects content, not the fact that you are using Kursal at all. Nothing in the design hides that from your network.
All three are documented in more detail, with the reasoning behind them, in our technical paper.
Vulnerability Disclosure
Security is at the core of Kursal. We encourage responsible disclosure of any vulnerabilities and are committed to addressing issues promptly.
Found a Vulnerability?
If you've discovered a security issue that might impact user privacy or safety, we'd greatly appreciate your help in reporting it.
Submit Vulnerability Report- ▸ Please provide detailed steps so we can reproduce and verify the issue.
- ▸ We kindly ask for 90 days to release a fix before public disclosure.
- ▸ We'll try our best to acknowledge your report within 48 hours.
Safe Harbour
If you research Kursal in good faith and stay within the scope below, we consider your testing authorised. We will not start or support any legal action against you for it, and if a third party comes after you over research we authorised, we will say so publicly and in writing. Accidents happen while testing: if you break something or reach data you did not expect to reach, stop, tell us, and we will treat that as part of the report rather than as a problem.
This is our promise, not a court's. It cannot bind a prosecutor or a third party whose systems you touch, which is exactly why the boundaries below matter.
In Scope
- ▸ kursal.chat and its subdomains
- ▸ The Kursal client, on any platform
- ▸ The protocol, the cryptography, and the paper
- ▸ Nodes and relays we operate ourselves
- ▸ Anything you run yourself, against yourself
Out of Scope
- ✗ Denial of service, load testing, or traffic flooding
- ✗ Nodes and relays run by the community, not by us
- ✗ Anything belonging to another user: messages, mailboxes, accounts, devices
- ✗ Social engineering, phishing, or physical access
- ✗ Automated scanner output with no demonstrated impact
No Bug Bounty
We do not pay for reports. Kursal is a student project with no revenue, and the money simply is not there. Saying so up front seems better than letting you find out after the work. What we can offer is a real answer from the person who wrote the code, a fix, and credit in our security acknowledgments if you want it.
Our Commitment
- ▸ Credit in our security acknowledgments (if desired)
- ▸ Regular updates on our progress addressing the issue
- ▸ Transparent communication throughout the process
General Issues
For bugs, feature requests, and non-security issues, please open an issue on GitHub:
Open GitHub IssueSecurity Practices
Code Security
- ▸ All code is open source and publicly auditable
- ▸ Continuous dependency vulnerability monitoring
Infrastructure
- ▸ All communications are end-to-end encrypted
- ▸ Resistant decentralized network
# For more details on our cryptographic implementation, read our technical paper or review the source code.