Compress everything. Trust nothing. Encrypt always.

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Do not open a public issue.** Email **ethicalhacker@riseup.net** with description, reproduction steps, and impact assessment. Response within 48 hours, fix within 30 days for critical issues.
+
+## Encryption Modes
+
+| Mode | Flag | Quantum-Safe | Key Type |
+|------|------|-------------|----------|
+| Password | `-p` | No | PBKDF2-SHA256 → AES-256 |
+| PQ Hybrid | `--pq` | **Yes** | ML-KEM-768 + X25519 → AES-256 |
+
+**Password mode is NOT quantum-safe.** It uses PBKDF2-SHA256 which provides only classical security. For protection against "harvest now, decrypt later" attacks, use `--pq` mode.
+
+## Threat Model
+
+**Protects against:** Stolen archives, brute-force passwords (600K PBKDF2), archive tampering (per-block HMAC-SHA256), wrong-password/key disclosure, data corruption (per-block XXH64), future quantum computers (`--pq` mode only).
+
+**Does NOT protect against:** Known password/key, cache-timing side channels (table-based AES/SHA-256), memory forensics, traffic analysis/deniability.
+
+## Algorithms
+
+| Component | Algorithm | Standard |
+|-----------|-----------|----------|
+| Post-quantum KEM | ML-KEM-768 | FIPS 203 |
+| Classical KEM | X25519 | RFC 7748 |
+| Hybrid KDF | SHA3-512(ml_ss ⊕ x_ss ‖ transcript) | Custom (documented) |
+| Block encryption | AES-256-CTR | FIPS 197 |
+| Block authentication | HMAC-SHA256 | RFC 2104 |
+| Password KDF | PBKDF2-SHA256 | RFC 8018 |
+| Integrity | XXH64 | xxHash spec |
+| Hashing | SHA3-256, SHA3-512, SHAKE-128/256 | FIPS 202 |
+| Random | /dev/urandom / RtlGenRandom | OS CSPRNG |