nodkey is a security tool. Security reports are important to us.

Please do not open a public issue for a security problem.

Report it privately on GitHub: open the Security tab and choose Report a vulnerability. Tell us what you found, how to repeat it, and what an attacker could do with it.

We will answer within 7 days.

Anything that breaks a promise in THREAT-MODEL.md section 4, or a protection described in section 6, for example:

• the agent gets a secret or an SSH signature without an approval;
• a secret value shows up in a log, an error, the audit log or a Telegram message;
• a tap approves a different request than the one shown;
• the broker signs data that is not an SSH login for the shown host.

The limits in THREAT-MODEL.md section 5 are known and are not bugs, but ideas to make them smaller are welcome as normal issues.

There is no release yet. Until 1.0, only the latest release gets fixes.