Security

Found a way BitDinghy could harm the people using it? Please tell us privately first, so it can be fixed before anyone else knows.

How to report

Email hello@bitdinghy.com with “Security” in the subject.

Please include:

• the BitDinghy version (dinghy --version) and your Windows version,
• what the problem is and what someone could do with it,
• the steps, link, .torrent file or code that shows it (if a file is involved, describe it or attach it, but please don’t send anything harmful to other people),
• whether you’d like to be thanked by name when it’s fixed.

Please don’t post it publicly (issues, forums, social media) until it’s fixed.

What happens next

• You get a reply within 7 days, usually sooner. BitDinghy is made by one person, so please be patient around holidays.
• The problem is checked, fixed in a new release, and explained in What’s new.
• You’re told before the fix is published, and thanked by name if you want.

Only the newest version gets security fixes. If you use an older one, please update.

What counts

Anything in BitDinghy or this website that could put its users at risk, for example:

• a link, .torrent file or peer that makes BitDinghy write, change or delete files outside the download folder, or overwrite files it didn’t download,
• anything received from the internet that makes BitDinghy run code, crash in a harmful way, or use up memory or disk without limit,
• another program or computer reaching BitDinghy’s private channel between dinghy and the window,
• BitDinghy sending something it shouldn’t (see Privacy),
• a release file that doesn’t match its published checksum,
• a problem with this website that could mislead or harm its visitors.

Not security problems: what other people share through BitTorrent (BitDinghy doesn’t host or choose content), the fact that peers see your IP address (that’s how BitTorrent works, see the FAQ), and issues in GitHub’s or Cloudflare’s own services (report those to them).

Good-faith research

If you look for security problems in good faith, report them privately as described here, give reasonable time for a fix, and don’t harm other people or their data, BitDinghy won’t take legal action against you for that research. Please test only on your own computers and with your own files.

How BitDinghy protects you

• Everything received from the network is treated as untrusted and checked before use: magnet links and .torrent files are rebuilt from checked parts, and file names that are dangerous on Windows are refused.
• Files are only ever written inside the download folder you chose. Files BitDinghy didn’t download are never overwritten or deleted.
• Web links to .torrent files use https:// by default, with size and redirect limits.
• The channel between dinghy and the window can only be used from your own computer.
• Every release is built by GitHub from BitDinghy’s source code and comes with a SHA-256 checksum.

This page’s contact details are also in machine-readable form at /.well-known/security.txt.