sshkeyd runs as root and writes SSH authorized_keys files, so a security vulnerability here can compromise account access on the target host. Please report suspected vulnerabilities privately rather than opening a public issue.

To report a vulnerability, use one of:

• GitHub private security advisory: open the repo → Security → Report a vulnerability. This is the preferred channel.
• Email: send details to the maintainer directly if no advisory channel is available yet.

Please include:

• A description of the issue and the impact you believe it has.
• The affected version or commit SHA.
• Steps to reproduce, or a proof of concept.
• Any suggested mitigation or fix.

You should receive an acknowledgment within 72 hours. Please do not disclose the issue publicly until a fix has been released and you have been notified.

In scope:

• Bypassing mTLS client-certificate verification or the revocation list.
• Writing to an unintended user's authorized_keys (e.g. via ssh_username handling, path traversal, or ownership checks).
• Public-key parsing bugs that allow weak or options-laden keys.
• Crashes or undefined behavior in the file-write path that corrupt authorized_keys.
• Local privilege escalation via the daemon.

Out of scope (but still welcome as hardening suggestions):

• Issues that require an attacker to already hold the CA private key.
• Issues in dependencies that are tracked upstream — report them upstream and we will pick up the fix on the next Dependabot update.

Only the latest release line receives security fixes.

Once a fix is released we will publish a GitHub Security Advisory and credit the reporter (unless they prefer to remain anonymous).