CipherM ships an offline desktop binary and runs a hosted registry at cipherm.io. They have different attack surfaces and almost nothing in common, so scope and architecture below are given separately. Reports on either are welcome.
Report privately before posting. You will get an acknowledgement, a fix, credit if you want it, and no legal action for good-faith research that respects this policy.
Email founder@cipherm.io. That is the single address, and it reaches the founder directly.
Include, as far as you have it:
Out of scope, both products
One person keeps these, so they are deliberately short of what a funded programme would promise. They are what can be met without inventing capacity that does not exist.
This page previously offered a free Pro tier for life. No Pro tier exists, none is on a roadmap with a date, and offering payment in a product that does not exist is worse than offering nothing. So: there is no cash bounty and no swag programme, because there is no budget for either.
What a valid report actually gets you:
If you find something that would have been worth real money at a company with a bounty budget, report it anyway and say so. You will get a straight answer about what CipherM can do rather than a vague promise to make it right.
What each product actually does, so you can decide where to spend your time — and so a buyer following the link from /procurement is reading the threat model of the thing they are buying.
One test detonates socket.socket, create_connection, getaddrinfo and gethostbyname before verifying a licence. Others read the source directly: the licence and rule-bundle modules have their ASTs walked for network-capable imports, and every file in the desktop package is scanned for references to urllib.request, http.client, socket.create_connection, requests, ssl.wrap_socket, ftplib, smtplib and telnetlib. `cipherm scan` refuses a git URL rather than fetching it. The frozen build additionally wraps socket connect, connect_ex, sendto and create_connection for the offline verbs — defence in depth and a self-check, not a sandbox, and it does not cover a C extension or a subprocess.
`cipherm tls <host>` and `cipherm certs --endpoint <host>` open outbound TLS to the target you typed, because a handshake cannot be measured without one. Neither contacts CipherM, and neither transmits the result anywhere. The full breakdown is on the procurement page.
It binds 127.0.0.1 and refuses any other address rather than trusting its caller. Every route returning scan data requires a per-run token compared in constant time, because another local process, a browser extension, or another user on a shared workstation can all reach 127.0.0.1. The Host header must name a loopback address, closing DNS rebinding through the assessor's own browser. Responses carry a strict CSP with no external origins, plus no-store, nosniff, no-referrer and frame-ancestors none; the page is a single self-contained file with no subresources, so it renders identically air-gapped.
The generated HTML is asserted to contain no script, iframe, object, embed, link, form, src=, href=, @import, fetch( or XMLHttpRequest. A pack opened in a browser on a connected machine transmits nothing about the code it describes.
Licence and rule-bundle verification are Ed25519 against keys compiled into the binary. There is no revocation channel and no remote kill switch, and CipherM has built no mechanism capable of disabling an installed copy. The trade is stated in the licence rather than hidden: no remote enforcement, no remote failure mode.
CBOMs are keyed by SHA-256, so identical uploads dedupe. The blob store is private and artifacts are served through the application, so the visibility check lives in one place rather than depending on an unguessable URL — which is not an access control.
The registry receives the CipherM-emitted CBOM, which carries file paths, line numbers and short snippets — not full source. Treat those snippets as disclosed. Public CBOMs are publicly readable by design: do not upload anything you would not commit to a public repository.
There is no application-layer encryption and no customer-held key. Anyone with production access to the infrastructure can read a private CBOM, and so can anyone who compels CipherM to. If that is unacceptable for a codebase, that codebase belongs on CipherM Desktop.
Pressing the AI migration button sends the rule id, file path, line number and up to 3,000 characters of the snippet already in your CBOM to Anthropic. Nothing does this on its own. The full subprocessor list is on the procurement page.
None is published, and the promise of one that this page used to carry has been removed rather than deferred again. Report over email; if the finding is too sensitive for plaintext, say so in a one-line message with no detail and a channel will be agreed before anything technical is sent.
founder@cipherm.io is a mailbox read by one person. There is no alias standing in front of a team, because there is no team. That is also why the response commitments below are modest enough to actually keep.
Neither exists and neither has been commissioned. This page will say so until one does. What stands in their place is documented on the procurement page, along with the key-person risk that comes with a one-person company.
Stated in full below rather than dressed up as an alternative rewards programme.
The full picture — compliance status, subprocessors, and the key-person risk of a one-person company selling an annual evidence licence — is on the procurement page. Nothing there is described as in flight.