If you discover a security vulnerability within Oathkeeper, please send an email to the project maintainers. All security vulnerabilities will be promptly addressed.

Please do NOT report security vulnerabilities through public GitHub issues.

The engine (oathkeeper_srv.exe) runs with administrator privileges via a scheduled task. This is necessary to:

• Modify the hosts file for website blocking
• Install keyboard hooks
• Monitor window titles

• Passwords are stored as SHA-256 hashes, never in plaintext
• Screenshots are stored locally in C:\ProgramData\Oathkeeper\screenshots
• No data is transmitted over the network

• The named pipe (\\.\pipe\OathkeeperPipe) uses a DACL that allows SYSTEM, Administrators, and the current user
• Commands are validated and sanitized before execution

• The engine maintains a backup of the original hosts file
• The "Re-enable Internet" feature restores the original hosts file
• DNS cache is flushed after modifying the hosts file

This project is licensed under the GNU General Public License v3.0.