Insecure Security Disclosure Policy (GSR-20)

Gossamer’s [current security policy](https://github.com/ChainSafe/gossamer#reporting-a-security-bug) recommends cleartext disclosure over an insecure medium of communication. No means for end-to-end encrypted communication is provided.

Provide and publish a means for sensitive information to be securely communicated to select, trustworthy individuals who are responsible for Gossamer’s security. This should involve end-to-end encryption. Advise that any sensitive security disclosures be made via this communication channel.

One solution could involve the same email address, but with the message contents encrypted via PGP/GPG.

If this is resolved via PGP/GPG, ensure the private key is appropriately stored in a secure manner.

The corresponding public key fingerprint should be published in several, independent places in order to minimse the risk that an attacker could replace the public key with their own. These could include the ChainSafe website, a public keyserver, `keybase.io`, Twitter and other social media platforms, ENS, DNS, and in the github organisation. Preferably, it should not be possible for an attacker to modify the fingerprint displayed in all these locations via a single compromised device.

Consider also allowing people to verify and sign this key during face-to-face meetings (or a master key).