Effective: July 1, 2026
1. Our Commitment to Security
White Dot takes security seriously. Our application is built with a security-first mindset, incorporating over 60 protective features spanning communication, account, infrastructure, device, and AI-based detection layers. We believe in transparency and welcome responsible disclosure of any vulnerabilities.
Security Posture
2. Bug Bounty Program
We operate a private bug bounty program for security researchers who demonstrate:
- Remote code execution (RCE) on production systems
- Privilege escalation allowing access to other users' data
- Authentication or authorization bypass
- Encryption bypass — breaking the confidentiality or integrity of E2EE
- Significant data leakage of user information
To apply for access to our bug bounty program, email security@whitedot.chat with your researcher profile and past findings.
3. Responsible Disclosure Policy
If you believe you have found a security vulnerability in White Dot, we encourage you to report it responsibly. We ask that you:
- Email your findings to security@whitedot.chat
- Provide sufficient detail to reproduce the issue
- Allow us reasonable time (90 days) to address the issue before any public disclosure
- Do not access, modify, or exfiltrate user data beyond what is necessary to demonstrate the vulnerability
- Do not exploit the vulnerability for any purpose other than testing
4. What We Promise
When you report a vulnerability to us in good faith:
- We will respond within 48 hours acknowledging receipt
- We will provide updates on remediation progress every 14 days
- We will not pursue legal action against you for the disclosure
- We will credit you in our security acknowledgments (with your permission)
- We will issue a bounty payment for qualifying findings
5. Out of Scope
The following are considered out of scope and are not eligible for bounty:
- Self-XSS or social engineering attacks
- Physical attacks on our infrastructure
- Denial of Service (DoS/DDoS) attacks
- Phishing or spam campaigns targeting our employees
- Vulnerabilities in third-party dependencies that are already disclosed by the vendor
- Theoretical attacks without a practical proof of concept
- Rate limiting bypasses (unless combined with a significant security impact)
6. Security Architecture Highlights
White Dot's security posture is built on these foundational principles:
- End-to-End Encryption: All messages, media, and calls are E2EE by default. Encryption keys are generated and stored on your device, never on our servers.
- Perfect Forward Secrecy: Each communication session uses ephemeral keys. Compromising one session's key does not expose past or future sessions.
- Zero-Knowledge Architecture: We designed the system so that we cannot access user content even if compelled to do so.
- Hardware-Backed Security: Keys are stored in device secure enclaves (Apple Secure Enclave, Android StrongBox).
- Continuous Security Monitoring: Real-time threat detection, automated secret rotation, and intrusion detection across all infrastructure.
7. Encryption Details
White Dot uses the following cryptographic primitives:
- Key Exchange: X25519 (Curve25519)
- Message Encryption: AES-256-GCM
- Hashing: SHA-256, BLAKE2b
- Signing: Ed25519
- Transport: TLS 1.3 with certificate pinning
8. Known Security Audits
White Dot undergoes regular third-party security audits. Our most recent audits:
- June 2026: Infrastructure penetration test — no critical findings
- March 2026: Mobile app security assessment — 1 medium finding (remediated)
- December 2025: Cryptographic protocol review — all clear
- September 2025: API security audit — 2 low findings (remediated)
9. Contact
To report a security vulnerability:
Email: security@whitedot.chat
PGP Key: Available on request
Response SLA: 48 hours