If you believe you've found a security issue in Sync, please report it privately to security@sync.buzz.

Please include:

• A description of the issue and the impact you believe it has.
• Steps to reproduce, or a minimal proof-of-concept.
• The affected version (git-sync --version or the commit SHA).
• Your platform (macOS / Linux / Windows) and any relevant configuration.

We aim to acknowledge reports within 72 hours and to publish a fix or a mitigation within 14 days for confirmed high-severity issues.

Please do not open a public GitHub issue for suspected security bugs. Public disclosure should happen only after a patched release is available.

Sync is pre-1.0. Only the latest release receives security updates.

The release binary embeds a 64-character BLAKE3 hash as an authorship canary (see crates/sync-app/src/main.rs::AUTHORSHIP_CANARY). The pre-image is held privately by the project owner.

If you need to verify that a given binary or commit was authored by the project owner, contact owner@sync.buzz. The owner can publish the pre-image on request; once disclosed, anyone can verify it locally:

printf '%s' '<disclosed pre-image>' | b3sum

The output must match the canary in the source tree (and in the binary, where it is reachable via strings target/release/git-sync). Git history then attests that the canary has been present since the initial commit.