Security

This page documents what RVNT does cryptographically, how we test it, and how to report vulnerabilities.

Cryptographic Protocol

Key Exchange

Extended Triple Diffie-Hellman (X3DH) with hybrid post-quantum key encapsulation. X25519 for classical ECDH, ML-KEM-768 for quantum resistance. Both must be broken to compromise a session.

  • X25519 ephemeral keys
  • ML-KEM-768 (FIPS 203)
  • Hybrid KEM combiner
  • Prekey bundles with signed prekeys

Double Ratchet

Every message uses a unique encryption key derived through the Double Ratchet algorithm. Compromise of one key reveals nothing about past or future messages.

  • AES-256-GCM symmetric encryption
  • HKDF-SHA256 key derivation
  • Per-message ratchet step
  • 2000 message skip limit

Sealed Sender

The server never learns who sent a message. Sender identity is encrypted inside the message envelope, visible only to the recipient after decryption.

  • Encrypted sender certificate
  • Server sees only recipient
  • Cover traffic for timing resistance
  • Tor onion routing

Fuzz Testing

We continuously fuzz every cryptographic boundary. These numbers represent total iterations with zero crashes.

226,000,000+ envelope fuzzing iterations
164,000+ ratchet state machine iterations
1,500,000+ sealed sender iterations
81,000,000+ mesh protocol iterations
4,800,000+ QR verification iterations

Zero crashes. Zero panics. Zero memory safety violations.

Test Coverage

91.6% line coverage

522+ tests across unit, integration, and property-based test suites. Every cryptographic primitive, every protocol state machine, every serialization boundary.

Bug Bounty

We pay for vulnerabilities. If you find a way to break RVNT's cryptographic guarantees, we want to know.

CRITICAL $5,000

Remote code execution, key extraction, plaintext recovery, authentication bypass.

HIGH $2,000

Metadata leaks that deanonymize users, cryptographic downgrade attacks, sealed sender bypass.

MEDIUM $500

Denial of service, information disclosure of non-sensitive data, protocol state corruption.

LOW $100

UI redress, minor information leaks, issues requiring physical access.

Responsible Disclosure

Report vulnerabilities to:

security@rvntos.io

Encrypt your report with our security team's GPG key. We will acknowledge receipt within 24 hours and provide an initial assessment within 72 hours.

We will not pursue legal action against researchers who follow responsible disclosure practices. We ask for 90 days before public disclosure.