Only the latest release is actively supported with security fixes.

For the purposes of the EU Cyber Resilience Act (Regulation (EU) 2024/2847) — which enters full application on 11 December 2027 — the declared support period for security updates on the latest release is at least 24 months from that release's publication date. Security-relevant fixes may be back-ported to the immediately preceding minor version on a best-effort basis; users are expected to upgrade to the latest release as their supported path.

Please do not open a public GitHub Issue for security vulnerabilities.

Report vulnerabilities privately via GitHub's private vulnerability reporting.

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Android version and app version (Settings → About this app)

You will receive a response within 7 days. If the vulnerability is confirmed, a fix will be released as soon as possible, and you will be credited in the release notes unless you prefer otherwise.

CurrenciX follows a coordinated disclosure model:

1. Report privately via the channel above.
2. Acknowledgement target: 7 days.
3. Triage and severity assessment: 14 days.
4. Fix + coordinated public disclosure: as soon as a fix is available. Reporter is credited unless anonymity is requested.
5. If a reported issue is not a vulnerability, the reporter is told why within the triage window.

Public disclosure before a fix is available is discouraged. Reporters who wish to disclose on a fixed schedule should say so in the initial report; a 90-day default disclosure window is honoured.

The CRA's vulnerability-reporting obligations apply from 11 September 2026. Any actively exploited vulnerability affecting a CurrenciX build distributed into the EU market in the course of a commercial activity will be reported to ENISA:

• Early warning: within 24 hours of the maintainer becoming aware.
• Vulnerability notification: within 72 hours.
• Final report: within 14 days of a fix or mitigation being available.

Users affected by the vulnerability will be notified via the GitHub release notes and, where feasible, an in-app changelog entry.

Each GitHub release carries an SBOM, currencix-<version>-sbom.cdx.json (CycloneDX 1.6 JSON), listed in its SHA256SUMS. It enumerates every direct and transitive runtime dependency of the release APKs with version, licence and, where the repository publishes one, hash, to meet CRA Annex I Part II §1 and downstream supply-chain audit requests. It's generated by the CycloneDX Gradle plugin (./gradlew :app:cyclonedxDirectBom, configured in app/build.gradle.kts), in the release workflow and on every PR's release build (see docs/markDown/engineering/ci-cd.md). Dependabot, OSV-Scanner (which reads this SBOM on every PR and weekly) and the weekly OWASP Dependency Check watch the same dependencies for known vulnerabilities. Each release file also carries signed build provenance: gh attestation verify <file> --repo EliorMachlev/CurrenciX shows which commit and workflow run built it. The build itself only accepts dependencies whose checksums are recorded in gradle/verification-metadata.xml.

This app:

• Requests only INTERNET, ACCESS_NETWORK_STATE, POST_NOTIFICATIONS (rate alerts, asked for at runtime) and USE_BIOMETRIC (the optional app lock); see docs/markDown/engineering/security.md
• Stores no personal data
• Contains no accounts or payment flows; the optional app lock is checked on the device only
• Communicates only with exchange rate providers (the one selected by the user, and the fallback provider, asked at the same time so its answer is ready if the first fails) and, for receipt scanning and only after the user agrees, GitHub for OCR language data and, in the Play build, Google Play for the receipt reader

Issues related to third-party exchange rate APIs should be reported directly to those providers.

• docs/markDown/engineering/security.md — full security posture (supply chain, secrets, network, code analysis).
• docs/markDown/legal/compliance-posture.md — regulatory applicability posture (EU AI Act, DSA/DMA, financial regimes, EAR/EU Dual-Use, CRA readiness).
• docs/markDown/legal/privacy-policy.md — privacy notice.
• docs/markDown/legal/accessibility-statement.md — accessibility statement.
• docs/markDown/legal/terms-of-service.md — terms of service.