nodkey is a security tool. Security reports are important to us.

Please do not open a public issue for a security problem.

Report it privately on GitHub: open the Security tab and choose Report a vulnerability. Tell us what you found, how to repeat it, and what an attacker could do with it.

We will answer within 7 days.

Anything that breaks a promise in THREAT-MODEL.md section 4, or a protection described in section 6, for example:

• the agent, or a command the agent runs, gets a secret, or the agent gets an SSH signature, without an approval;
• a secret value shows up in a log, an error, the audit log or a Telegram message;
• a tap approves a different request than the one shown;
• the broker signs data that is not an SSH login for the shown host.

The limits in THREAT-MODEL.md section 5 are known and are not bugs, but ideas to make them smaller are welcome as normal issues.

Until 1.0, only the latest release gets fixes. To get a fix, upgrade to the newest release (docs/setup.md section 13).

A release that fixes a security problem has a ### Security section first in its notes and in CHANGELOG.md. A line there may name the advisory (GHSA-xxxx-xxxx-xxxx). The pull request of the fix has the type security: (docs/releasing.md).