Security and compliance

CrabNebula stewards qrtc as free and open-source software under MIT OR Apache-2.0. This page summarises how it is built and maintained. COMPLIANCE.md is the authoritative statement.

Reporting a vulnerability

Use GitHub's private vulnerability reporting on the repository (Security tab, "Report a vulnerability"). Please do not open a public issue. Reports are acknowledged within 5 working days, and a disclosure date is agreed with the reporter: by default 90 days after the report, or earlier once a fix is released.

Cyber Resilience Act

CrabNebula supplies qrtc outside any commercial activity, so under Regulation (EU) 2024/2847 it acts as an open-source software steward (Article 3(14)), not as a manufacturer. The steward obligations of Article 24 apply: a documented cybersecurity policy, cooperation with market surveillance authorities, and Article 14 reporting to the extent CrabNebula is involved.

A manufacturer that integrates qrtc into a product on the market carries the CRA obligations for that product. It must exercise due diligence on qrtc as a component (Article 13(5)). COMPLIANCE.md has a table of the facts that due diligence needs.

What the build contains

No unsafe code of qrtc's own.
With turn-tls-rustcrypto, no C code. The only -sys crates bind platform APIs: the Windows and Apple certificate stores.
Cryptography: RustCrypto for DTLS, SRTP and certificates; rustls for TURN over TLS; ML-KEM from moduletto or RustCrypto ml-kem.
Not validated under FIPS 140-3 or any other certification scheme.

Supply chain

SBOM. sbom/qrtc.cdx.json, CycloneDX 1.5, for the default build. CI fails when it drifts from Cargo.lock, and each release attaches it.
Advisories. cargo-deny checks the RustSec database on every push and weekly. Each ignored advisory carries its reason in deny.toml.
Provenance. Releases come from signed tags, with SHA-256 sums and GitHub build provenance attestations.
Vendored code. Every change to a vendored crate is listed on Vendored crates.

Ignored advisories

Advisory	Crate	Why it does not apply
RUSTSEC-2026-0049, -0098, -0099, -0104	rustls-webpki 0.102.8	Reached only through the pre-release `rustls-rustcrypto` provider, for algorithm id constants. Certificate path validation uses rustls-webpki 0.103.
RUSTSEC-2023-0071	rsa	A timing leak in RSA private-key operations. qrtc holds no RSA private key, and TURN over TLS uses no client certificate.
RUSTSEC-2024-0436	paste	Unmaintained proc-macro, build time only.

All six come from the turn-tls-rustcrypto path. The default build with ring is not affected by them.

Protocol security notes

DTLS peers authenticate by certificate fingerprint, carried in the SDP. The signalling channel must protect the SDP; Matrix and LiveKit do so with TLS and, for Matrix, end-to-end encryption.
Under prefer, an attacker on the media path can make the auto-sensing handshake fall back to classical DTLS 1.2. The fallback checks the RFC 8446 downgrade sentinel, so a peer that itself speaks DTLS 1.3 and saw a stripped ClientHello fails the handshake rather than connecting classically. Against a peer that only speaks DTLS 1.2 there is no post-quantum key agreement at all. Use require when both ends are known to support the hybrid; tlsGroup in the transport stats reports what was negotiated.
Host candidates carry mDNS .local names, not interface addresses. Remote .local names are resolved only when they have the shape browsers generate, at most eight at a time per peer connection.
TURN: once the long-term credential is in use, responses without a valid MESSAGE-INTEGRITY are discarded (RFC 8489 section 10.2.3), except the 400, 401 and 438 errors a server sends before authenticating. MESSAGE-INTEGRITY is compared in constant time.
TURN over TLS checks the server certificate against the platform trust store, with Mozilla's roots as the fallback.
Randomness: X25519 keys, ML-KEM seeds, the DTLS certificate key and serial, ICE credentials, STUN transaction ids and the ICE tie-breaker come from the operating system. DTLS hello randoms, cookies and explicit nonces come from rand's thread-local ChaCha generator, seeded from the OS. RTP identifiers (SSRC, sequence numbers, VP8 PictureID) use str0m's fast generator, reseeded from the OS on every engine thread. Key material is zeroized when dropped; ICE passwords are redacted from trace logs.

Security reviews

Reviews and their findings are recorded under audits/. The 2026-10-10 review covered the engine, the vendored patches, randomness, the build and release pipeline; its findings are fixed in the same change set, with one accepted risk (moduletto is a git dependency on a branch). SECURITY.md has the reporting process.