The app
- All communication with our server uses TLS. The app contains no API keys or secrets; administrative tools are gated by credentials stored in the iOS Keychain, never in the app bundle.
- Sign-in uses Apple or Google identity tokens, verified on our server by signature, issuer and audience. Our own access tokens are short-lived; refresh tokens are stored hashed, rotated on every use, and a reused token revokes its whole family.
- User-written text (display names, comments, mesh messages) is rendered as plain text — never as HTML or markup — so it cannot run code in anyone's app.
- Display names are filtered so that no user can pose as an authority (e.g. names containing "JMA", "気象庁", "official", "admin").
Alerts
- Alert pushes originate only from JMA messages received by our server. Endpoints that trigger alerts manually (for testing) require an administrator token; they are not reachable by users.
- Cancellations replace the original alert on your device under the same identifier.
- We keep a public record of incidents affecting alert correctness in our field notes.
The server
- Hosted in Tokyo. Firewall allows only HTTPS (and SSH by key). Automated intrusion blocking is active.
- Database on a private interface; all queries parameterised.
- Public positions in Community are rounded to about 1 km before leaving the server.
SHINDO Node
- Messages between contacts are encrypted end to end on the phone using Apple's CryptoKit; relaying nodes see only ciphertext and routing data.
- Contacts are exchanged with a QR code or pairing link that includes the contact's public key.
- Known limitation: current firmware does not yet lock Bluetooth configuration to the owner; a nearby person could change a node's preset. Owner pairing is in development and will ship before devices are sold.
Report a vulnerability
Please email security@shindoalert.com with steps to reproduce. We acknowledge within three business days, keep you informed, and credit you here if you wish. We ask that you do not trigger alerts to other users, access data that is not yours, or disrupt the service while testing. We do not run a paid bounty programme yet.